Set a safe umask before creating temporary files

Although glibc's implementation of mkstemp creates temporary files with
a safe (i.e. 0600) mode, POSIX does not mandate any particular mode.  So
to ensure maximum cross-platform safety, we must set a umask of 0077
before calling mkstemp.