To use OCSP, the client accessing EFS must be able to reach the Amazon Certificate
Authority (CA). To maximize file system availability in the event that the CA is
not reachable from your VPC, the EFS mount helper no longer enables OCSP by default.

See here for more info:

https://aws.amazon.com/about-aws/whats-new/2019/07/configuration-update-for-amazon-efs-encryption-data-in-transit/

`os.makedirs()` uses default mode 0777 in Python2. Therefore the
protection level of the state_file_dir depends on the inherited umask. A
default mode of 0750 is a good conservative default for this. To allow
admins and system integrators to tune this setting it is configurable
via the new config file setting 'state_file_dir_mode'.

This also requires to adjust test_bootstrap_tls to cover the new config
option.

* Improve detection of root user
* Require OCSPaia and checkHost options for stunnel
* Install and use a hand-managed trust store

Includes a mount helper utility (mount.efs), an associated watchdog
process, unit tests, and build scripts.

The utility simplifies mounting and using EFS file systems and
optionally enables clients to mount over a TLS tunnel.