Fix based on Coverity and Sonar audits (part 3) - #22331

* api: tighten management API key file permissions to 0600

Sonar c:S2612 (MAJOR vulnerability): the management API key file was
created with `open(..., O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 444)`. The
literal `444` is decimal, not octal, which equals octal 0674 = rw-rwxr--.
Group gets read+write+execute and others get read on a file that stores
the management API key (a UUID granting admin endpoint access). Anyone
with local read on the host can lift the key.

Even if the original intent was octal `0444` (world-readable), a
secret-key file should not be readable by group or others. Use `0600`
(owner read+write only), the standard mode for secrets.

* file_lock: tighten lock file creation mode from 0666 to 0600

Sonar c:S2612: file_lock_get() created the advisory lock file with
mode 0666 (rw-rw-rw-). Netdata runs as a single dedicated user, so
group/other access is unnecessary and adds latent risk if any local
user can interfere with the lock file.

flock(2) is purely advisory and does not enforce by mode, but the open()
permission still controls who can create/access the file. Owner-only
0600 keeps the locking behavior intact for the netdata user while
preventing unrelated local users from creating or opening the file.

The function is currently unused (its caller in src/daemon/main.c is
commented out), but it is exposed in the public header and may be
revived for single-instance enforcement; tightening the default now
avoids carrying permissive bits forward.

* listen-sockets: drop misleading exec bit from UNIX socket chmod (0777 -> 0666)

Sonar c:S2612: create_listen_socket_unix() chmod'd the bound UNIX socket
file to 0777. For UNIX domain socket files only the read/write
permissions affect client connect() access -- the execute bit is unused.
0777 and 0666 are functionally identical for socket connect.

Both callers (web API and statsd) intentionally allow arbitrary local
clients to connect, so the broad rw permission is preserved with 0666.
The execute bit was misleading and unnecessary; remove it and update
the explanatory comment.

---------

Co-authored-by: Costa Tsaousis <costa@netdata.cloud>
(cherry picked from commit d6029b8)