Create the master key file readable by its owner only

[Dmytro-Hladkykh]

The key file is created with a plain open(), so it gets whatever the umask gives (0664 in
practice), readable by any local user on the host.

It's now created 0600 with os.open(), where the mode is set as the file is created - a
chmod afterwards would leave a short window where the key is readable by everyone. O_EXCL so
an existing key can't be overwritten.

On load, a key readable by group or other is now a startup error rather than a warning.

This stops other local users reading the key. It doesn't get it away from www-data - uwsgi
reads it as www-data by design, and nginx workers are www-data too.

To check, with the key owned by www-data and mode 0600:

$ docker exec -u nobody blockstream-blind-oracle_node_1 cat /server_private_key.key
cat: /server_private_key.key: Permission denied

# still works
$ docker exec -u www-data blockstream-blind-oracle_node_1 cat /server_private_key.key
<key>