Restrict access to extracted plugin files

CHANGELOG · original

Fixed plugin archives extracted for a session being readable by other local users, extracted files keeping world-writable bits from the archive, and stale files surviving re-extraction