fix(fs): require sys permission for umask (#36222)
## Summary
- add `umask` as a scoped `allow-sys` permission
- require that permission when querying or changing the process umask
- document the requirement for both `Deno.umask()` and the shared Node
operation
- add coverage for Deno and Node query/set behavior, including worker
permissions
## Testing
- `cargo fmt --all -- --check`
- `./tools/format.js --check cli/tsc/dts/lib.deno.ns.d.ts ext/fs/ops.rs
ext/node/polyfills/process.ts runtime/permissions/lib.rs
tests/unit/umask_test.ts`
- `cargo build -p deno`
- `cargo test -p deno_permissions`
- `cargo test -p unit_tests --test unit -- umask_test`
- direct `process.umask()` query/set checks with `--allow-sys=umask` and
`--deny-sys=umask`
