fix(app): publish downloads with umask permissions and add destination flags

Downloads were created like temporary files, readable by their owner only.
They now get the permissions the umask allows, as files a shell redirection
creates; API responses written with --output-file stay private. An
--output-file that is a directory is reported as such instead of "output
file already exists", and a download written to a terminal refuses binary
data and strips control sequences from text.

downloadFlags gives download commands the gh destination flags: -O/--output
(a file, a directory, or - for stdout; --output-file stays as a hidden alias),
-D/--dir, --clobber and --skip-existing, with the download's own name as the
default destination. Names that would escape the destination are refused.

Signed-off-by: bircni <bircni@icloud.com>

internal/app/integration_helpers_test.go

@@ -197,7 +197,7 @@ func verifyIssueAttachmentLifecycle(t *testing.T, deps Dependencies, group, repo
 	require.Equal(t, "Disposable attachment content\n", string(content))
 	info, err := os.Stat(downloaded)
 	require.NoError(t, err)
-	require.Equal(t, os.FileMode(0o600), info.Mode().Perm())
+	require.Equal(t, umaskMode(t), info.Mode().Perm())
 	deleted := false
 	defer func() {
 		if !deleted {