Enforce owner-only access for secure files and directories on Windows

[peteski22]

Problem

perms.SecureFile (0600) and perms.SecureDir (0700) express the intent that execution-context files and their directory are readable only by the owning user. That guarantee is implemented through POSIX mode bits, which Windows does not have: Go ignores the mode passed to os.WriteFile/os.MkdirAll on Windows and NTFS access is governed by ACLs instead.

Since the Windows fixes for #218 (branch fix/windows-permissions), mcpd no longer rejects its own directories on Windows, but it also does nothing to restrict them. Access to %USERPROFILE%\.config\mcpd and the cache currently rests on the inherited ACL of the user's profile directory, which is user-private by default but is not something mcpd checks or enforces.

Proposal

• When creating a secure file or directory on Windows, apply a DACL that grants access only to the current user (and optionally SYSTEM/Administrators), replacing inherited ACEs. This needs golang.org/x/sys/windows (SetNamedSecurityInfo / SECURITY_DESCRIPTOR helpers).
• EnsureAtLeastSecureDir on Windows should verify the DACL rather than skipping the check entirely, mirroring the "equal or more restrictive" rule used on Unix.
• Regular (0644/0755) files and directories can keep inherited ACLs.
• Cover with Windows-only tests that inspect the resulting DACL.

Notes

• The Unix behavior must not change.
• internal/files/files_windows.go (validateDirPermissions) is the current no-op to replace.