Add _xxx_fix_pkg_permissions to fix the libsa.3.gz and /root
permissions in the target pkg database until pkg metalog generation
is fixed upstream, _xxx_pkg_db_dump_or_vacuum to verify and compact
the target pkg database after the manual SQL edits and dump it as a
backup (also helps produce deterministic images), and
_xxx_pkg_add_var_db_files_to_metalog to add the generated
/var/db/pkg files to the metalog, since pkg does not emit entries
for files it generates locally.

Also document _xxx_pkg_metalog's existing permission fixups by
referencing the same upstream pkg issue and adding before/after
permission examples, matching the rationale given for
_xxx_fix_pkg_permissions above.