privsep: Handle all file IO in the Priviledged Actioneer

privsep: Handle all file IO in the Priviledged Actioneer

This allows us to move the database directory back into the
root of the filesystem.
While here, harden the files by denying any user read access to them.

As part of this change, init the DUID from any machine data and
cache the default DHCP vendor field before dropping priviledges as we
may lose access to this later.