Also lock down backup and restore directories

This constricts from an os.ModePerm, which is 0777 down to 0770,
similarly just dropping the world bits.

Signed-off-by: Matt Robenolt <matt@ydekproductions.com>

go/vt/mysqlctl/builtinbackupengine.go

@@ -207,7 +207,7 @@ func (fe *FileEntry) open(cnf *Mycnf, readOnly bool) (*os.File, error) {
 		}
 	} else {
 		dir := path.Dir(name)
-		if err := os.MkdirAll(dir, os.ModePerm); err != nil {
+		if err := os.MkdirAll(dir, 0770); err != nil {
 			return nil, vterrors.Wrapf(err, "cannot create destination directory %v", dir)
 		}
 		if fd, err = os2.Create(name); err != nil {

go/vt/mysqlctl/filebackupstorage/file.go

@@ -173,13 +173,13 @@ func (fbs *FileBackupStorage) ListBackups(ctx context.Context, dir string) ([]ba
 func (fbs *FileBackupStorage) StartBackup(ctx context.Context, dir, name string) (backupstorage.BackupHandle, error) {
 	// Make sure the directory exists.
 	p := path.Join(FileBackupStorageRoot, dir)
-	if err := os.MkdirAll(p, os.ModePerm); err != nil {
+	if err := os.MkdirAll(p, 0770); err != nil {
 		return nil, err
 	}
 
 	// Create the subdirectory for this named backup.
 	p = path.Join(p, name)
-	if err := os.Mkdir(p, os.ModePerm); err != nil {
+	if err := os.Mkdir(p, 0770); err != nil {
 		return nil, err
 	}