package mapping rule "attributes" should be more strongly defined

The current `pkg_attributes` macro has undefined behavior: each argument defaults to None and as is left open to interpretation by the package builder. This can leave some things dependent on the environment, losing hermiticity. Most important ones are likely user and the group

Some non-mutually-exclusive options:

- Leave it as-is.
- Set defaults in `pkg_attributes`
- Allow for overriding default attributes in `pkg_filegroup`
- Codify the behavior in the packaging rules level