limit create file permissions

Be safe by default, create files so that other users can't read them,
at least until the original permissions are set.

This does have a side effect, if the restore creates directories that aren't included in the restore, the permissions aren't reset.
attic extract archive_file::name nested/stuff
if nested doesn't exist, it will be left with 0700 because it was created to restore files, but wasn't listed as something to restore, where
attic extract archive_file::name nested
would set the permissions to the original permissions.