Add file restrictions to ensure protection of user tokens

[shlevari]

Add file access restrictions to local file created that contains user tokens. Restrictions work on POSIX systems. On windows systems, still relies on correct permissions for folder structure to provide the protection.

[github-actions]

Hi! Thank you for opening this PR. Want me to review it?

Based on the diff (123 lines, 2 files), I've queued these reviewers:

• Correctness — logic errors, race conditions, lifecycle issues
• Security — vulnerabilities, secret exposure, injection
• API Compatibility — breaking changes, release tags, type design
• Performance — algorithmic regressions, memory leaks
• Testing — coverage gaps, hollow tests

How this works

• Adjust the reviewer set by ticking/unticking boxes above. Reviewer toggles alone don't trigger anything.

• Tick Start review below to dispatch the review fleet.

• After review finishes, tick Start review again to request another run — it auto-resets after each dispatch.

• This comment updates as new commits land; your reviewer selections are preserved.

• Start review

[Copilot]

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

[github-actions]

Bundle size comparison

Base commit: 4a9b42d1ed05f0b6406485096ea09c586b3bdad0
Head commit: 291c7b5f1c9b320be02517b0e554d9e36b9e0d3b

Notable changes

• 🔴 azureClient.js: parsed 619098 → 620271 (+1173), gzip 164828 → 165076 (+248)
• 🔴 odspClient.js: parsed 591824 → 592997 (+1173), gzip 158938 → 159180 (+242)
• 🔴 aqueduct.js: parsed 525587 → 526739 (+1152), gzip 140703 → 140931 (+228)
• 🔴 fluidFramework.js: parsed 394142 → 394843 (+701), gzip 111926 → 112132 (+206)
• 🔴 sharedTree.js: parsed 383529 → 384223 (+694), gzip 109311 → 109510 (+199)
• 🔴 containerRuntime.js: parsed 303937 → 305068 (+1131), gzip 83200 → 83411 (+211)

Per-bundle deltas

@fluid-example/bundle-size-tests

• 🔴 azureClient.js: parsed 619098 → 620271 (+1173), gzip 164828 → 165076 (+248)
• 🔴 odspClient.js: parsed 591824 → 592997 (+1173), gzip 158938 → 159180 (+242)
• 🔴 aqueduct.js: parsed 525587 → 526739 (+1152), gzip 140703 → 140931 (+228)
• 🔴 fluidFramework.js: parsed 394142 → 394843 (+701), gzip 111926 → 112132 (+206)
• 🔴 sharedTree.js: parsed 383529 → 384223 (+694), gzip 109311 → 109510 (+199)
• 🔴 containerRuntime.js: parsed 303937 → 305068 (+1131), gzip 83200 → 83411 (+211)
• sharedString.js: parsed 175984 → 175991 (+7), gzip 49445 → 49453 (+8)
• experimentalSharedTree.js: parsed 160798 → 160798 (0), gzip 45804 → 45804 (0)
• matrix.js: parsed 159845 → 159852 (+7), gzip 45411 → 45418 (+7)
• loader.js: parsed 145256 → 145270 (+14), gzip 39063 → 39076 (+13)
• odspDriver.js: parsed 104329 → 104350 (+21), gzip 32625 → 32635 (+10)
• directory.js: parsed 66616 → 66623 (+7), gzip 18532 → 18540 (+8)
• 748.js: parsed 58793 → 58793 (0), gzip 17827 → 17827 (0)
• map.js: parsed 46709 → 46716 (+7), gzip 14310 → 14317 (+7)
• odspPrefetchSnapshot.js: parsed 45642 → 45656 (+14), gzip 15277 → 15285 (+8)
• 985.js: parsed 44491 → 44491 (0), gzip 13726 → 13726 (0)
• summarizerDelayLoadedModule.js: parsed 30749 → 30749 (0), gzip 7753 → 7753 (0)
• socketModule.js: parsed 26476 → 26483 (+7), gzip 7887 → 7894 (+7)
• createNewModule.js: parsed 12480 → 12480 (0), gzip 4786 → 4786 (0)
• summaryModule.js: parsed 3797 → 3797 (0), gzip 1860 → 1860 (0)
• connectionState.js: parsed 724 → 724 (0), gzip 429 → 429 (0)
• sharedTreeAttributes.js: parsed 666 → 673 (+7), gzip 432 → 442 (+10)
• debugAssert.js: parsed 429 → 429 (0), gzip 299 → 299 (0)
• FluidFramework-HashFallback.js: parsed 422 → 422 (0), gzip 316 → 316 (0)