provisioners/chef: work with restrictive umask [GH-2121]