fix(cmd/register): service account key permissions

[bassosimone]

The service account key is written with 0644 permissions. Because it is a secret, it should instead be written with 0600.

I noticed this issue when analyzing byos-debian where the key is written to /var/lib/mlab/node. The directory itself is 02750 and this prevents users that are not in the mlab-node group from reading the file. However, in that context, services such as ndt-server are able to read the secret even though they do not need to. This patch doesn't address that, but I am working on another set of patches to privilege-separate core services and measurement services.

I did not spend time focusing on whether this was a security issue for autonode. As regards autonode, my main focus has been trying to understand whether changing the permissions could break it, and I concluded that this is not the case (see below).

To address the permissions, this patch does the following:

1. call os.WriteFile with 0600, which covers new files only while existing files are just truncated w/o a chmod

2. os.Chmod with 0600 thus covering already existing files

Following the Boy Scout rule, this patch also changes the wording and spelling of some comments and adds minor style tweaks.

Regarding why I am confident that autonode containers (and namely jostler and uuid-annotator) run as root, this is why:

1. the three Dockefiles do not specify USER

2. there is no user: in the docker-compose.yml

As such, this change is safe. Even if the file was owned by another user and had 0600, root holds CAP_DAC_OVERRIDE so it is able to read the service account key anyway.

---

This change is