Consider supporting (some) permissions during extraction

Right now we intentionally ignore all permissions on members during extraction, both for convenience's sake and because honoring them can be a subtle source of extraction problems (e.g. a stream that creates a directory without write permissions, and then wants to place a regular file underneath it).

We _might_ want to support a policy knob/setting for honoring a restricted subset of file modes, however.

No file, test, or entry point is named. Start by locating the extraction implementation and reviewing how directory and regular-file members are created; done means agreeing on a restricted permission policy, exposing the policy setting, and covering the directory-then-file extraction case with tests.

Written by the indexing model from the issue text.