fix: let umask do the thing (#10723)

We had a few places where we had perhaps too much of an opinion on the
permissions on created files and directories, sometimes fuled by a
misconception about how permissions work in both Unix and Windows. Recap
on the ground rules:

- On all unixes, all file & directory creation (`Mkdir`, `MkdirAll`,
`Create`, `WriteFile`, `Open`) has the given permission bits filtered
via the user's umask. The proper permissions for us to use are in almost
all cases 0o666 for files and 0o777 for directories, strange as that may
look at the call site.
- On Windows, there is no umask but in turn all of the permission bits
except the user write bit are ignored. The absence of user write bit is
converted into the read only attribute. This means that what is proper
for Unix above is also proper for Windows.
- We make an exception when creating files for certificate keys and the
config / database directories, as those contain secrets we think should remain closed
even if the user generally collaborates with other users on the system.

(Also removal of a bugfixed copy of MkdirAll for Windows that hasn't
been necessary for a few years.)

---------

Signed-off-by: Jakob Borg <jakob@kastelo.net>

lib/config/folderconfiguration.go

@@ -168,7 +168,7 @@ func (f *FolderConfiguration) CreateMarker() error {
 	ffs := f.Filesystem()
 
 	// Create the marker as a directory
-	err := ffs.Mkdir(DefaultMarkerName, 0o755)
+	err := ffs.Mkdir(DefaultMarkerName, fs.ModePerm)
 	if err != nil {
 		return err
 	}
@@ -176,7 +176,7 @@ func (f *FolderConfiguration) CreateMarker() error {
 	// Create a file inside it, reducing the risk of the marker directory
 	// being removed by automated cleanup tools.
 	markerFile := filepath.Join(DefaultMarkerName, f.markerFilename())
-	if err := fs.WriteFile(ffs, markerFile, f.markerContents(), 0o644); err != nil {
+	if err := fs.WriteFile(ffs, markerFile, f.markerContents(), 0o666); err != nil {
 		return err
 	}
 
@@ -246,19 +246,10 @@ func (f *FolderConfiguration) checkFilesystemPath(ffs fs.Filesystem, path string
 }
 
 func (f *FolderConfiguration) CreateRoot() (err error) {
-	// Directory permission bits. Will be filtered down to something
-	// sane by umask on Unixes.
-	permBits := fs.FileMode(0o777)
-	if build.IsWindows {
-		// Windows has no umask so we must chose a safer set of bits to
-		// begin with.
-		permBits = 0o700
-	}
-
 	filesystem := f.Filesystem()
 
 	if _, err = filesystem.Stat("."); fs.IsNotExist(err) {
-		err = filesystem.MkdirAll(".", permBits)
+		err = filesystem.MkdirAll(".", fs.ModePerm)
 	}
 
 	return err