ensure safe perms for svs.sqlite and sync_flag

[sssoleileraaa]

Description

Fixes #1232

Test Plan

• Build deb for the client and install on sd-app or just patch it with this PR change
• Delete ~/.securedrop_client (you can manually copy config.json if you want but it's not necessary to test this change)
• Start the client via commandline by running: securedrop-client
• Confirm svs.sqlite and sync_flag now have 600 perms instead of 644

[emkll]

rebased on latest main

[emkll]

Changes here work well, but it's important to note that it will not update existing svs.sqlite and sync_flag files: These changes will only work if/when those files are created by the client. I think this is fine to merge as-is.

[sssoleileraaa]

@emkll - to address your feedback, i updated the client to fix insecure perms when it starts. follow the test plan, but instead of deleting ~/.securedrop_client just modify the permissions of the files to something like 644 to test this new behavior.

[emkll]

Thanks @creviera for the changes, went through another round of testing, looks good to me!