wireguard module: generatePrivateKeyFile: Fix chmod security race

[nh2]

Fixes #121288.

Until now, the touch + chmod 600 + write approach made it possible for
an unprivileged local user read the private key file, by opening
the file after the touch, before the read permissions are restricted.

This was only the case if generatePrivateKeyFile = true and the parent
directory of privateKeyFile already existed and was readable.

This commit fixes it by using umask, which ensures kernel-side that
the touch creates the file with the correct permissions atomically.

This commit also:

• Removes mkdir --mode 0644 -p "${dirOf values.privateKeyFile}"
  because setting permissions drw-r--r-- ("nobody can enter that dir")
  is awkward. drwx------ would perhaps make sense, like for .ssh.
  However, setting the permissions on the private key file is enough,
  and likely better, because privateKeyFile is about that file
  specifically and no docs suggest that there's something special
  about its parent dir.
• Removes the chmod 0400 "${values.privateKeyFile}"
  because there isn't really a point in removing write access from
  the owner of the private key.

Motivation for this change

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[dotlambda]

This is automatic:

nixpkgs/nixos/modules/system/boot/systemd.nix

Line 213 in c709fd4

#!${pkgs.runtimeShell} -e

[nh2]

Yes, but who knows if it will stay that way forever; thus especially for the more sensitive stuff, it may be good to be explicit.

(Also evidently a ton of shell users don't know about set -e, that it's off by default, and on-by-default in some NixOS scripts, so they may get surprises when copying scripts from one place to the other.)

[nh2]

I've added a release notes entry.