fix(config): keep the credentials file readable by its owner alone

[tas50]

cinc created a new credentials file with mode 0600, because os.OpenFile's mode only applies on create. Rewriting an existing file kept whatever mode it had. Knife setups often leave ~/.chef/credentials, and files copied from it, at 0644. So after cinc config create or first-run setup updated such a file, its profiles, which name private keys and data bag secrets, stayed readable by every user on the machine.

WriteProfileWithExtras, the one place a credentials file is written, now sets the file to 0600 before writing anything into it. That covers config create (add, update and replace), first-run configure and migration. On Windows Chmod only controls the read-only bit, and 0600 keeps the file writable, so nothing changes there.

docs/configuration.md now says the file is kept readable by its owner alone. It also gets the config validate --profile example missing from #256.

Tests

• TestWriteProfileTightensAnExistingFile: a 0644 file becomes 0600 after an update.
• A new integration case, cli/config-create-tightens-permissions, updates a profile in a 0644 credentials file through the real binary, checks the file is 0600, and checks the new profile works.