getDiagnosticsData fails: www-data cannot mkdir /var/www/html/userdata on SSVM (Permission denied)

# problem

Retrieving diagnostics from a system VM fails. The archive is collected on the target VM, but the async job then errors and no download URL is produced:

```
Unable to create a link for entity at diagnostics//diagnostics_files_.zip on ssvm, Error in creating directory =mkdir: cannot create directory '/var/www/html/userdata//': Permission denied
```

Expected: the job succeeds and returns a usable download URL.

# versions

- CloudStack 4.22.1.0 (management and agents)
- System VMs from the stock `systemvm-kvm-4.22.0` template, not customized
- KVM hypervisors, NFS secondary storage

# The steps to reproduce the bug

1. Run `getDiagnosticsData` against a running system VM, e.g. `cmk get diagnosticsdata targetid= files=/var/log/cloud.log`.
2. Wait for the async job to complete.
3. The job fails with errorcode 530 and the error above.

# What to do about it?

The download directory is created as the `www-data` user ([UploadManagerImpl.java#L277-L291](https://github.com/apache/cloudstack/blob/4.22/services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/template/UploadManagerImpl.java#L277-L291)), but the docroot on the SSVM is not writable by `www-data`. Shipping `/var/www/html/userdata` owned by `www-data` in the system VM template, or creating it as root and chowning, would fix it. `extractVolume`/`extractTemplate` downloads use the same directory and may be affected as well; only the diagnostics case is verified.

Workaround on a running SSVM: `mkdir -p /var/www/html/userdata && chown www-data:www-data /var/www/html/userdata` (lost on SSVM recreation).

Commencez par les lignes 277-291 de UploadManagerImpl.java et reproduisez getDiagnosticsData sur une VM système en cours d’exécution à l’aide de la commande indiquée dans l’issue. Vérifiez comment le modèle SSVM crée /var/www/html/userdata et lui attribue ses permissions, y compris les chemins associés de extractVolume et extractTemplate. Le travail est terminé lorsque le job asynchrone réussit et renvoie une URL de téléchargement utilisable sans contournement manuel.

Rédigé par le modèle d'indexation à partir du texte de l'issue.