Keep a trusted Firefox policies.json when repairing the directory

A world-writable distribution dir failed the hardened check even when
policies.json was already root-owned, and setup then overwrote it.

migrations/1787515927.sh

@@ -20,5 +20,9 @@ fi
 for dir in "${BROWSER_POLICY_FIREFOX_DIRS[@]}"; do
   [[ -d $dir ]] || continue
   browser_policy_firefox_hardened "$dir" && continue
-  browser_policy_setup_firefox_distribution "$dir"
+  as_root install -d -m 0755 -o root -g root "$dir"
+  browser_policy_purge_dir "$dir"
+  if ! browser_policy_firefox_policy_file_ok "$dir/policies.json"; then
+    browser_policy_install_firefox_policies "$dir"
+  fi
 done

test/shell.d/browser-policy-dir-test.sh

@@ -251,6 +251,8 @@ grep -F 'browser_policy_grant_user' "${migrations[0]}" >/dev/null ||
   fail "the policy-directory migration still grants the current user the group"
 grep -F 'BROWSER_POLICY_FIREFOX_DIRS' "${migrations[0]}" >/dev/null ||
   fail "the policy-directory migration covers Firefox and Zen"
+grep -F 'browser_policy_firefox_policy_file_ok' "${migrations[0]}" >/dev/null ||
+  fail "the policy-directory migration keeps a trusted Firefox policies.json"
 grep -F '/opt/zen-browser/distribution' "$ROOT/install/helpers/browser-policy.sh" >/dev/null ||
   fail "the shared helper names the Zen distribution directory"
 pass "a migration locks existing policy directories"