`cabal-install` does not fully respect the `umask`

Unfortunately, it seems that the `cabal` repository offers no means to report security issues; so I’m sending this issue description using the means for reporting ordinary bugs.

When I run `cabal clean` and then `cabal build` with the `umask` set to `0077`, several of the files that `cabal-install` creates under `dist-newstyle` and also `dist-newstyle` itself have permissions `rwxr--r--` or `rwxr-xr-x`. This is completely at odds with what a typical Unix user would expect: a utility that has nothing to do with file permissions (like `chmod` has) should always create new files with permissions that arise from taking a maximal permission set suitable from the perspective of the application (typically `rw-rw-rw-`, `rwxrwxrwx`, or `rw-------`) and removing permissions according to the user-provided `umask`. What makes the problem worse is that the user has apparently no means to force Cabal to use more privacy-friendly permissions.

Digging in the Cabal source code, I found the following bit, which might be the cause of this problem: https://github.com/haskell/cabal/blob/575a694a2d540a81f18db78debaecb240ea7ffac/Cabal/src/Distribution/Compat/CopyFile.hs#L64-L67 This makes me wonder *who* are the ones (“we”) who “want to install files and directories that are accessible to other users” on my machine when I run `cabal-install`. I also wonder what the reason for giving other users access is. After all, if a user creates build products, these build products are typically intended for just this user. If they are also intended for others, then the user can set the `umask` accordingly before invoking `cabal-install`.

The correct behavior would be for Cabal to chose `rwxrwxrwx` for directories and executables and `rw-rw-rw-` for all other files as default permissions and use as actual permissions these default permissions without those permissions marked by the `umask`. In the case of a `umask` of `0077`, this would result in the permissions `rwx------` and `rw-------`, respectively.

Following is a shell session that provides some information about the platform where I have experienced the above-described malfunction:
```sh
$ uname -srvmpio
Linux 6.12.67 #1-NixOS SMP PREEMPT_DYNAMIC Fri Jan 23 10:18:52 UTC 2026 x86_64 unknown unknown GNU/Linux
$ ghc -V
The Glorious Glasgow Haskell Compilation System, version 9.12.2
$ cabal -V
cabal-install version 3.16.0.0
compiled using version 3.16.0.0 of the Cabal library (in-tree)
```