Enforce 0644 for file-based secret providers

[dliub]

Summary

• centralize file writes behind a helper that enforces 0644
• use that helper from the AWS Secrets Manager, Azure Key Vault, and AWS IAM auth file providers
• add regression tests covering both new-file creation and overwriting an existing 0600 file

Why

In initcontainer mode the proxy calls Refresh() directly, so the provider-specific writeFile() mode is what lands on the shared emptyDir. Before this change, file_azure_key_vault wrote files with 0600 while file_aws_secrets_manager wrote them with 0777, which produced inconsistent readability across providers.

Using os.WriteFile(..., 0644) alone is not sufficient when the file already exists with a more restrictive mode, so the helper also calls os.Chmod(..., 0644) after writing.

Testing

• go test -vet=off ./provider -run TestWriteSecretFile
• go test -vet=off ./provider/aws_secrets_manager -run ^
• go test -vet=off ./provider/azure_key_vault -run ^
• go test -vet=off ./provider/aws_iam_auth_rds -run ^