fix(auth): harden Windows storage bridge

tools/tht/internal/safeio/private_windows.go

@@ -96,8 +96,16 @@ func ProtectPrivateRegular(path string) error {
 // createCanonicalNewPrivateFile installs the owner-only protected DACL in the CreateFile call, so
 // another mutation can never observe a newly-created lock with an inherited/default DACL.
 func createCanonicalNewPrivateFile(path string, mode os.FileMode) (*os.File, error) {
+	return createCanonicalNewFile(path, mode, false)
+}
+
+func createCanonicalNewPrivateParentFile(path string, mode os.FileMode) (*os.File, error) {
+	return createCanonicalNewFile(path, mode, true)
+}
+
+func createCanonicalNewFile(path string, mode os.FileMode, requirePrivateParent bool) (*os.File, error) {
 	parents, target, err := openCanonicalWindowsParent(path)
-	if err != nil || len(parents.handles) == 0 || validateOwnerOnlyDACL(parents.handles[len(parents.handles)-1]) != nil {
+	if err != nil || len(parents.handles) == 0 || (requirePrivateParent && validateOwnerOnlyDACL(parents.handles[len(parents.handles)-1]) != nil) {
 		if parents != nil {
 			parents.Close()
 		}