Document bst artifact checkout behaviour with regards to permissions

Currently (this may change) bst artifact checkout follows umask. But --hardlinks results in permissions which are the same as are what CAS since items are simply symlinks there. In latter case permissions commonly are different than the original permissions in sandbox, in former permissions might randomly be same depending on umask. (potentially BuildStream should ensure umask for checkout is actually same as sandbox umask but this is another matter) This behaviour is not at all obvious and has resulted in confusion in freedesktop-sdk so we need to document it.

Start by locating the documentation for artifact checkout and the --hardlinks option. Record how umask affects regular checkouts, how permissions differ with hardlinks and CAS symlinks, and clarify that matching sandbox permissions is a separate concern. Done means the permission behavior and its source of confusion are explicit.

Written by the indexing model from the issue text.