wrap file copy in umasks to secure permissions

* salt.util.copyfile needs preceding with 54 (aka 0066) umask in order
  for new files to correctly get 0600 mode permissions.
* shutil.copyfile is preceded by a 63 (aka 0077) umask.

Fixes issue #8590