Add ability to 'mask off' sections of a configtree: the is a simple application of the config diff function which will allow a unified treatment of enabled sections of config-sync. In addition, it avoids some technical annoyances when trying to map a section given by a single leaf node to a config_dict format. The first case, under this task, is an inclusion mask, namely include only those paths of a config that share a full path of the mask; this can be generalized a bit if useful to add a subsequent ecxlusion mask.