fix: authorize the destination collection a copy or move replaces

A COPY or MOVE onto an existing destination replaces it, which destroys
everything the destination collection held. Only the source subtree was
authorized per descendant, and the destination itself was authorized as an
update, so a rule restricting a subtree held against DELETE but not against
an overwrite of the collection above it. Removing a collection is now
authorized the way DELETE on it would be, on the collection and on every
path beneath it. Writing over a file stays an update.

README.md

@@ -121,6 +121,9 @@ directory: /data
 # permissions. For example, to allow to read and create, set "RC". Default is "R".
 # LOCK counts as a write: it needs U on a path that exists and C on one that does
 # not, since locking a path that does not exist creates it.
+# Being overwritten counts as well: a COPY or MOVE onto an existing file replaces
+# it and needs U, while one onto an existing collection removes everything it
+# holds and needs D, on the collection and on every path under it.
 permissions: R
 
 # The default permissions rules for users. Default is none. Rules are applied
@@ -244,6 +247,8 @@ A `regex` rule is matched literally against the path, and gets none of the above
 
 Rules apply to every path an operation touches, not only the one it names. Collection listings leave out entries the rules deny, copying a collection leaves those entries behind, and a `MOVE` or `DELETE` that would act on a denied descendant is refused outright.
 
+Overwriting a destination is authorized for what it destroys. A `COPY` or `MOVE` onto an existing destination replaces it: RFC4918 has `MOVE` perform a `DELETE` with `Depth: infinity` on the destination first, and requires an overwritten collection to end up with exactly the membership the source had, so either way whatever was there is gone. Replacing a file needs `U` on it, the same permission `PUT` needs. Replacing a collection removes everything it holds, so it needs `D` on that collection and on every path beneath it: a rule withholding `D` anywhere under a destination refuses the overwrite outright, even where it grants `C` and `U`.
+
 Rules follow the case sensitivity of the file system, which each served directory is probed for at startup. Where names are case-insensitive, as on APFS and NTFS, `path: /secret/` also covers `/SECRET/`, a `regex` is matched against the folded path as well as the path as written, and Unicode normal forms count as one name. Elsewhere rules are matched exactly, since `/secret` and `/SECRET` are then different directories.
 
 ### CORS