Add option to enforce umask

When deploy.require-umask is set to an octal umask trigger will
only allow commands to be run if the umask is set to the required
umask given. This excludes the help command.