tmpfiles: be more careful when adjusting chmod() + chown()

tmpfiles: be more careful when adjusting chmod() + chown()

chown() might drop the suid/sgid bit from files. hence let's chmod()
after chown().

But also, let's tighten the transition a bit: before issuing chown()
let's set the file mask to the minimum of the old and new access
bitmask, so that at no point in time additional privs are available on
the file with a non-matching ownership.

Fixes: #12354