virtio/fs/macos: secctx must succeed with 0444

On macOS fsetxattr fails with EPERM if the file has been created with a
mode where the owner lacks write permissions, even if the file handle
itself does have the ability to write to the inode.

We need the write the security context for the file even in those cases,
so if setxattr/fsetxattrs fails with EACCES or EPERM, change the file
mode, retry setting the security context, and restore the file mode.

macOS lacks a syscall for doing this atomically, so this is the best
thing we can do.

Fixes: #769

Signed-off-by: Sergio Lopez <slp@redhat.com>