nixos/conduit: improve state directory permissions

Allow only the conduit user to access its database files, and make sure
to create all new files with 0600 (o+rw).

nixos/modules/services/matrix/conduit.nix

@@ -138,10 +138,12 @@ in
             "~@privileged"
           ];
           StateDirectory = "matrix-conduit";
+          StateDirectoryMode = "0700";
           ExecStart = "${cfg.package}/bin/conduit";
           Restart = "on-failure";
           RestartSec = 10;
           StartLimitBurst = 5;
+          UMask = "077";
         };
       };
     };