Puppet run must set the configured ACLs in any case.

[renepavlik]

When we make a manual change of ACLs after a puppet run (for testing or so) and want to set them back to desired state by another puppet run, refresh only for exec:

 exec { '/usr/local/sbin/fooacl':
    refreshonly => true,

makes it impossible to do so, since the script file didn't change.