Ensure safe umask before writing temporary repo from remote

pkg(8) already sets umask(022) on startup, but this may be called via
the library interface.

Reported by:	Coverity Scan