base-filesystem: pick more conservative access mode for /root/
    
    Let's not allow anyone to look into /root/ if we create it via the
    base-filesystem logic. i.e. change 0755 → 0750 as default access mode
    for /root/, in case we create it if it happens to be missing.
    
    (cherry picked from commit 93cbc9ca12043a13a2a80087a00012e009216f13)