Clarify the file permissions for downloaded files

- Along with explaining umask usage, the default file permissions were
  updated from 664 to 666 to better mirror `open()`.

src/briefcase/integrations/download.py

@@ -118,10 +118,24 @@ def _fetch_and_write_content(self, response, filename):
                             temp_file.write(data)
                             progress_bar.update(task_id, advance=len(data))
 
+            # This file move short circuits to a file rename when the source and
+            # destination are on the same filesystem; therefore, it should complete
+            # quite quickly even for large files.
             self.tools.shutil.move(temp_file.name, filename)
-            # retrieving the current umask requires changing it...
+            # Temporary files are created with only read/write permissions for the
+            # file's owner (i.e. 600); to match the behavior of file creation using
+            # ``open(..., w)``, the downloaded file's permissions are updated for
+            # the group and world to have read/write permissions as well. Finally,
+            # (as with ``open()``) the system's umask is respected. The current
+            # umask is only available as the return value to updating the umask...
+            # Updating the umask affects the current process, including all threads.
+            # A umask value represents permissions that should be denied; so, 022
+            # denies write permissions to the group and world. A 022 umask is a
+            # common default among supporting systems.
             os.umask(current_umask := os.umask(0o022))
-            self.tools.os.chmod(filename, 0o664 & ~current_umask)
+            # The umask is applied by inverting it and bitwise ANDing the default
+            # permissions...thus masking out permissions that should be denied.
+            self.tools.os.chmod(filename, 0o666 & ~current_umask)
         finally:
             # Ensure the temporary file is deleted; this file may still
             # exist if the download fails or the user sends CTRL+C.