use last entry in acl
use last entry in acl

This will allow for `effective` permissions to be looked at when the package
manager updates the system.

```
$ getfacl httpd/

user::rwx
group::---
group:webmaster:r-x		#effective:---
mask::---
other::---
```

Fixes #44932

saltstack/salt,saltstack/salt,saltstack/salt,saltstack/salt,saltstack/salt