Fix non-root salt CLI when publisher_acl is configured (#65317)

[dwoz]

What does this PR do?

Restores non-root salt CLI access on masters running as the salt user when publisher_acl or external_auth is configured. The master now adds the world-execute bit to sock_dir and cachedir so authorised non-root users can traverse into them to reach the IPC sockets and per-user key files.

What issues does this PR fix or reference?

Fixes #65317

Previous Behavior

After upgrading to 3006.3 (where the master defaults to running as the salt user) non-root callers configured in publisher_acl lost access to the salt CLI:

$ salt '*' test.ping
[ERROR   ] Unable to connect to the salt master publisher at /var/run/salt/master
The salt master could not be contacted. Is master running?

Manually loosening sock_dir got them past that error and onto the next failure:

Authentication error occurred.

Both symptoms came from the runtime/packaging leaving /var/run/salt/master and /var/cache/salt/master mode 0o750 owned by salt:salt. The CLI's os.path.exists(publish_pull.ipc) check and check_path_traversal walk of cachedir both fail because the user has neither read nor execute on those parents.

New Behavior

When publisher_acl or external_auth is configured, the master adds the world-execute bit (no world-read) to:

• sock_dir — done in EventPublisher.run next to the existing master_event_pub.ipc 0o660 chmod, gated on the same condition.
• cachedir — done in salt.daemons.masterapi.access_keys next to where per-user .<user>_key files are already being created and chowned.

Directory listings stay hidden; individual sockets/files inside still rely on their own perms (master_event_pub.ipc remains 0o660 group salt, key files remain 0o600 chowned to their user). The chmod is idempotent and never narrows existing perms. Operators who have not opted into non-root usage (no publisher_acl/external_auth) see no change.

Merge requirements satisfied?

• Docs (no documented behavior changes; the existing publisher_acl docs at https://docs.saltproject.io/en/latest/ref/publisheracl.html already cover the use case being restored)
• Changelog
• Tests written/updated

Tests

• tests/pytests/unit/test_issue_65317_non_root_publisher_acl.py (5 cases): asserts access_keys adds o+x to cachedir when publisher_acl/external_auth is set, leaves it untouched without ACLs, preserves more-permissive existing modes, and short-circuits cleanly when cachedir is missing.
• tests/pytests/functional/master/test_event_publisher_perms.py (2 cases): spawns the EventPublisher process and verifies sock_dir ends up with o+x when publisher_acl is configured, and is left alone otherwise.

Commits signed with GPG?

Yes