wrap file copy in umasks to secure permissions

* salt.util.copyfile needs preceding with 54 (aka 0066) umask in order
  for new files to correctly get 0600 mode permissions.
* shutil.copyfile is preceded by a 63 (aka 0077) umask.

Fixes issue #8590
apply mask or state mode to copied files.

This makes salt.utils.copyfile secure by default. After use, correct file
permissions according to the mode in the state or, if not specified, the umask.
Merge pull request #8818 from gotvach/issue-8590

wrap file copy in umasks to secure permissions