`EACCES` is returned if the file mode bit (i.e., user/group/other rwx
bits) disallow access.  `EPERM` is returned if something else denies
access (immutable bit, SELinux, capabilities, etc).  This somewhat subtle
no-access distinction is part of POSIX.  For now map both to
`error.PermissionDenied` to keep the error signature unchanged.  See
duopoly.

This PR is effecitvely an update/simplification of PR #19193.

Tested locally with an immutable file.

Fixes #22733 and #19162.