Add a more restrictive mode to the lock file.

os.open's default is 0777. With 0644 some other user can't come along and delete the lock file, letting another cron job run concurrently.

(Editing this through Github; I haven't run tests.)