Uses umask to avoid creating world-readable files.

Uses `umask` to ensure decrypted files are created without read/write/execute permissions for others. This is better than `chmod`'ing, because the permissions are set _before_ the file contains sensitive info.

Provides an environment variable `DECRYPT_UMASK` to set the `umask` to use. Defaults to `o=`, which means no access for others.

There was a `chmod o-rwx`. I removed it because it's no longer necessary.