Approved API Proposal: #41614
Original PR merged in 5.0: #42099
Related change for directory creation method that takes an ACL: #41834 [merged and ported to 3.1 Prev2]

Description

We have extension methods in System.IO.FileSystem.AclExtensions that let the user get and set ACLs for existing files, but we do not have methods that create files with predefined ACLs.
.NET ACL (Access Control List) support is Windows specific. This change will reside inside the System.IO.FileSystem.AccessControl assembly.

Customer impact

Before this change, customers had to create a file or filestream, then set its ACLs. This presents a few problems:

• Potential security hole as files can be accessed between creation and modification.
• Porting difficulties as there isn't a 1-1 API replacement
• Stability issues with background processes (file filters) can prevent modifying ACLs right after creation (typically surfaces as a security exception).

This change addresses those problems by adding a new extension method that allows creating a file and ensuring the provided ACLs are set during creation.

Regression

This change will not cause a regression.

Risk

Medium-Low:

• Customers will only be able to test this change directly in 3.1 GA.
• ACL changes are risky because if they are set incorrectly by our APIs, we cannot fix them via servicing, since the ACLs will already have been written to filesystems everywhere.
• This change did almost no changes to existing codepaths, so the risk is contained inside the new code only.

Testing

Added unit tests that verify the ACLs were correctly set and the expected exceptions are thrown.