Strict file mode (permissions) setting?

Currently, AGH creates most of its files and directories with permissions like `0o644` (`-rw-r--r--`) for non-executable files and `0o755` (`-rwxr-xr-x`) for executables and directories. CWE and securego.io recommend these to be no greater than `0o600` (`-rw-------`) and `0o750` (`-rwxr-x---`) correspondingly.

I propose that we add a setting, `strict_file_mode`, which makes AGH make these `0o600` and `0o750`/`0o700`. I would like it to be set to `true` by default, but that could break people's backup and other scripts. Perhaps it should only be `true` for new installations?

@ameshkov, what do you think?

Related:

* #764.
* #3198.