write secret and key files atomically with their final mode

Each of these wrote its file in place (or set the mode after the
write), so a write cut short by a kill or a full disk left a partial
file behind, and some secrets existed for a moment at umask mode:

- swarm-authelia/swarm-grafana/hive-forge/swarm-bao generators: a
  partial file passed the `-s`/`-e` guard and was kept forever. They now
  capture the value first and land it with `atomic_write_secret`.
- swarm-controller webhook secret: a truncated file failed the 64-hex
  check and the secret was regenerated, out of step with the forge
  hooks. It is now written 0600 to a sibling temp, fsynced, renamed.
- hive-c0re htpasswd: the temp is now fsynced and set 0644 before the
  rename, like the sibling agents.conf writer, instead of relying on
  c0re's umask.
- hivectl wg init: the private key is created 0400 in a temp and
  renamed, instead of written at umask mode and chmod'ed after.

Closes #5068

nix/host-modules/swarm-grafana.nix

@@ -735,10 +735,13 @@ in
             ];
             script = ''
               set -euo pipefail
+
+              ${atomicWriteSecret}
+
               key=${lib.escapeShellArg secretKeyPath}
               if [ ! -s "$key" ]; then
-                umask 077
-                openssl rand -hex 32 > "$key"
+                value=$(openssl rand -hex 32)
+                atomic_write_secret 0600 "" "$key" "$value"
                 echo "generated Grafana's datasource encryption key"
               fi
             '';