chore: Update create-secrets script to restrict file permissions

The create-secrets script has been updated to restrict file permissions to 400, ensuring that the secrets file is only accessible by the owner. This improves the security of the secrets stored in the file.

imageroot/bin/create-secrets

@@ -7,14 +7,16 @@
 
 set -e
 
-# restict to 400
-umask 266
+
 
 if [[ ! -d ~/.config/state/secrets ]]; then
     /usr/bin/mkdir -p ~/.config/state/secrets
 fi
 
+# restict to 400
+umask 266
+
 if [[ ! -f ~/.config/state/secrets/passwords.secret ]]; then
     password_postgres=$(/usr/bin/openssl rand -hex 20)
     /usr/bin/echo "POSTGRES_PASSWORD=$password_postgres" > ~/.config/state/secrets/passwords.secret
-fi
+fi