fix(os): use a canonical build umask

Author: kvinwang

os/mkosi/build.sh

@@ -1,6 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: Apache-2.0
 set -euo pipefail
+umask 0022
 SELF=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 ROOT=$(cd "$SELF/../.." && pwd)
 # shellcheck source=/dev/null

os/mkosi/scripts/make-release-artifacts.sh

@@ -1,6 +1,7 @@
 #!/bin/bash
 # SPDX-License-Identifier: Apache-2.0
 set -euo pipefail
+umask 0022
 ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)
 SELF="$ROOT/os/mkosi"
 # shellcheck source=/dev/null