Restrict config files to owner access

[selviarora]

Config#set creates files with mode 0644 under the usual 022 umask, allowing other local users to read credentials when the containing directories are traversable. Updates preserve those broad permissions.

Create configs with 0600 permissions, subject to a stricter umask. When replacing an existing config, retain only its owner read/write bits: 0644 and 0640 become 0600, while 0400 stays 0400. This also prevents the temporary file from being made group/world-readable before the atomic rename. Symlink targets receive the same protection without replacing the symlink.

Existing configs are tightened on their next successful write. Applications intentionally sharing config files through group/other permissions will now lose that access when writing through Config#set.

Validation on Ruby 3.4.3 with locked dependencies:

• bundle exec rake test: 143 runs, 664 assertions, 0 failures/errors, 7 existing skips.
• bundle exec rake style: 62 files, no offenses.
• bundle exec srb tc: no errors.
• Regression checks cover five umasks, five existing file modes, and symlink targets; the new permissions checks fail against the original implementation.
• A temporary-directory reproduction changes both initial creation and token rotation from 0644 to 0600 under umask 022.

Independent of #541, which removes values from config write errors. The two changes merge cleanly.