fix(cmd): write k6 config with owner-only permissions (0o600/0o700) - #6011

What?

The on-disk k6 config file (default ~/.config/k6/config.json) can contain the Grafana Cloud API token under collectors.cloud.token, persisted by k6 cloud login and read back by k6 cloud run, k6 cloud test, and the launcher's build-service auth. It was previously written with mode 0o644 inside a directory created with mode 0o755, leaving the token readable by any other local user on shared hosts (CI runners, multi-user dev boxes, sidecar containers, container images that bake in $HOME) — an attacker could lift the token and impersonate the user against Grafana Cloud.

Tighten the modes to 0o600 for the file and 0o700 for the directory. afero's WriteFile and MkdirAll don't change permissions on pre-existing paths, so an explicit Chmod is performed after each, so existing installs are upgraded the next time writeDiskConfig runs (e.g. the next k6 cloud login). The modes are exposed as named constants (configFileMode, configDirMode) so the policy is documented in one place.

Add regression tests covering both the fresh-install case and the upgrade path (pre-existing 0o644 file / 0o755 directory get tightened on the next write).

Checklist

• I have performed a self-review of my code.
• I have commented on my code, particularly in hard-to-understand areas.
• I have added tests for my changes.
• I have run linter and tests locally (make check) and all pass.