When writing to a file, call fchmod() to ensure the file mode matches
the intended mode, which is 0444. This was already done when replacing
an existing file, but not when creating a new file, which meant if the
process umask was 077, the resulting certificates and bundle would be
unreadable by unprivileged users.

MFC after: 1 week