diffapply: do chown before xattrs

[sipsma]

Chown will result file capabilities getting reset, so it should be done
before setting xattrs to ensure they are retained.

Signed-off-by: Erik Sipsma erik@sipsma.dev

The included test failed before only on the snapshotter w/ disable hardlinking. Passes after the new fix.

[thaJeztah]

Does this fix the issue reported in moby 23.0? or are changes needed on the moby side for that? (does this one need cherry-pick?)

[sipsma]

@thaJeztah The moby issue was a combination of two orthogonal problems:

1. Merged snapshots on disk didn't preserve file capabilities (this was true in both vanilla buildkit and moby-flavored buildkit)
2. Images exported from merged snapshots were incorrectly flattened into a single layer derived directly from the merged snapshot (this was only a problem in moby, not vanilla buildkit)

The PR here fixes 1 but not 2. 2 needs to be fixed in moby.

I think 1 on it's own is pretty obscure since it only affected local snapshots, not exported container images (it's only in combination w/ 2 that it's much worse). So I'll defer to @tonistiigi on whether we should backport this or not. It shouldn't be hard if desired.