getDiagnosticsData fails: www-data cannot mkdir /var/www/html/userdata on SSVM (Permission denied)

# problem

Retrieving diagnostics from a system VM fails. The archive is collected on the target VM, but the async job then errors and no download URL is produced:

```
Unable to create a link for entity at diagnostics//diagnostics_files_.zip on ssvm, Error in creating directory =mkdir: cannot create directory '/var/www/html/userdata//': Permission denied
```

Expected: the job succeeds and returns a usable download URL.

# versions

- CloudStack 4.22.1.0 (management and agents)
- System VMs from the stock `systemvm-kvm-4.22.0` template, not customized
- KVM hypervisors, NFS secondary storage

# The steps to reproduce the bug

1. Run `getDiagnosticsData` against a running system VM, e.g. `cmk get diagnosticsdata targetid= files=/var/log/cloud.log`.
2. Wait for the async job to complete.
3. The job fails with errorcode 530 and the error above.

# What to do about it?

The download directory is created as the `www-data` user ([UploadManagerImpl.java#L277-L291](https://github.com/apache/cloudstack/blob/4.22/services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/template/UploadManagerImpl.java#L277-L291)), but the docroot on the SSVM is not writable by `www-data`. Shipping `/var/www/html/userdata` owned by `www-data` in the system VM template, or creating it as root and chowning, would fix it. `extractVolume`/`extractTemplate` downloads use the same directory and may be affected as well; only the diagnostics case is verified.

Workaround on a running SSVM: `mkdir -p /var/www/html/userdata && chown www-data:www-data /var/www/html/userdata` (lost on SSVM recreation).

Inizia con le righe 277-291 di UploadManagerImpl.java e riproduci getDiagnosticsData su una VM di sistema in esecuzione usando il comando indicato nell'issue. Verifica in che modo il template SSVM crea /var/www/html/userdata e ne imposta i permessi, inclusi i relativi percorsi extractVolume ed extractTemplate. Il lavoro è completato quando il job asincrono ha esito positivo e restituisce un URL di download utilizzabile senza una soluzione manuale.

Scritto dal modello di indicizzazione a partire dal testo della issue.