Harden permissions for router PEM files containing private keys

Summary

Harden the permissions used for router PEM files that include TLS private-key material.

simpleCertificateWriter.WriteCertificate currently sets the temporary PEM file mode to 0644 before atomically renaming it into the HAProxy certificate directory. The combined PEM written by WriteCertificatesForConfig includes certObj.PrivateKey, so it should not be world-readable.

Required change

Update pkg/router/template/certmanager.go so simpleCertificateWriter.WriteCertificate uses restrictive permissions (0600) for PEM files containing private keys. Preserve the existing temporary-file cleanup, error logging, and atomic rename behavior.

Rationale

This is existing behavior rather than a regression introduced by PR #825, so it is being tracked separately. Restricting permissions reduces unnecessary exposure of TLS private-key material within the router container.

Affected area

• pkg/router/template/certmanager.go
• simpleCertificateWriter.WriteCertificate

Acceptance criteria

• PEM files written by WriteCertificate have mode 0600.
• The write remains atomic: write to a temporary file, close it, then rename it into place.
• Error cleanup and logging behavior remains intact.
• Relevant certificate writer tests are updated or added to verify the expected file mode.

Backlinks

• PR: https://github.com/openshift/router/pull/825
• Review discussion: https://github.com/openshift/router/pull/825#discussion_r3658729395

Requested by: @bentito