Fix security warnings about local information disclosure in temporary directories

[thomaslow]

This PR fixes 4 instances of the CodeQL security warning "Local information disclosure in a temporary directory".

The problem is that the old Java API File.createTempFile does not necessarily apply very restrictive permissions to these files such that other non-tomcat users may get access to them. Instead, it is now recommended to use the newer API Files.createTempFile (with an additional s). However, there is still no guarantee that files are assigned the most restrictive permissions available. The official documentation of Files.createTempFile only states:

When no file attributes are specified, then the resulting file may have more restrictive access permissions to files created by the File.createTempFile(String,String,File) method.

We could also try to set specific permissions, but I couldn't find an OS-independent way to do this.

Testing these changes in my Ubuntu 26.04 docker container (my tomcat runs as root user inside the container) reveals the following access permissions, which seem reasonable to me.

For a temporary directory (created by the ImageManagement class):

drwx------+  1 root   root      0 Aug 28 10:39 ImageManagement.tmpDir17890399326253926715

For a temporary file within that directory:

-rw-------+   1 root root   0 Aug 28 11:02 sizedWebImage-6578674863344965441.jpeg

Previously, the global /tmp directory was used (which can be accessed by everyone), and files had the following permissions:

-rw-r-----+  1 root root   0 Aug 28 10:39 sizedWebImage-12077786332429147037.jpeg

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}