shell: restrict export file permissions, rollback policy on user create failure

- s3.iam.export: use os.OpenFile with mode 0600 instead of os.Create
  to protect exported credentials from other users
- s3.user.provision: rollback the created policy if CreateUser fails,
  with a warning if the rollback itself fails

weed/shell/command_s3_iam_export.go

@@ -59,7 +59,7 @@ func (c *commandS3IAMExport) Do(args []string, commandEnv *CommandEnv, writer io
 
 		var out io.Writer = writer
 		if *file != "" {
-			fp, err := os.Create(*file)
+			fp, err := os.OpenFile(*file, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
 			if err != nil {
 				return fmt.Errorf("create file: %v", err)
 			}

weed/shell/command_s3_user_provision.go

@@ -156,7 +156,11 @@ func (c *commandS3UserProvision) Do(args []string, commandEnv *CommandEnv, write
 		}
 		_, err = client.CreateUser(ctx, &iam_pb.CreateUserRequest{Identity: identity})
 		if err != nil {
-			return fmt.Errorf("create user: %v", err)
+			// Rollback: remove the policy we just created
+			if _, delErr := client.DeletePolicy(ctx, &iam_pb.DeletePolicyRequest{Name: policyName}); delErr != nil {
+				fmt.Fprintf(writer, "Warning: failed to rollback policy %q: %v\n", policyName, delErr)
+			}
+			return fmt.Errorf("create user: %w", err)
 		}
 		fmt.Fprintf(writer, "Created user %q with policy %q attached\n", *name, policyName)