create the resumable index store with owner-only permissions

[madib06ops]

PropertiesBasedResumableProcessor.save() writes the download index to the fixed path $java.io.tmpdir/ahc/ResumableAsyncHandler.properties, creating the directory with mkdirs() and the file with createNewFile(), so both land with umask-default permissions in the shared temp directory and the write follows whatever is at that path. On a multi-user host any local user can then read the URLs being downloaded (userinfo and query tokens included), or plant a symlink at that predictable path before the shutdown hook fires and have the client truncate the file it points to; load() followed the same symlink on the way back in, so a planted file also feeds forged resume offsets to the handler. The store is now created 0700/0600 and reopened with CREATE_NEW after a delete, so a raced re-plant fails the open instead of being written through, and load() reads with NOFOLLOW_LINKS. Both checks live in the processor because it owns the path, and the new test fails on the current code with rw-r--r-- and with the symlink target overwritten.