fix(auth): harden Windows auth store privacy

tools/tht/internal/safeio/files.go

@@ -77,6 +77,10 @@ func WriteCanonicalNewFile(path string, contents []byte, mode os.FileMode) error
 		return ErrUnsafeFile
 	}
 	defer file.Close()
+	if err := ProtectPrivateRegular(path); err != nil {
+		_ = os.Remove(path)
+		return ErrUnsafeFile
+	}
 	if _, err := file.Write(contents); err != nil {
 		_ = os.Remove(path)
 		return ErrUnsafeFile