Harden permissions for pipe used in SharedServer.

[cincuranet]

No description provided.

[Copilot]

Pull request overview

This PR tightens Unix named-pipe (Unix domain socket) filesystem permissions when PipeOptions.CurrentUserOnly is used, by explicitly setting the socket file’s mode to user-only (0600). This aligns the on-disk endpoint permissions with the “current user only” intent and adds a regression test.

Changes:

• Set the Unix domain socket file mode to UserRead | UserWrite when creating a SharedServer for CurrentUserOnly.
• Add a Unix test validating the socket file mode when CurrentUserOnly is specified.
• Minor refactors to use PipeOptions.HasFlag(...) in a few places.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
src/libraries/System.IO.Pipes/src/System/IO/Pipes/NamedPipeServerStream.Unix.cs	Applies 0600 permissions to the bound socket path for CurrentUserOnly; adds cleanup on failure; refactors option checks.
src/libraries/System.IO.Pipes/tests/NamedPipeTests/NamedPipeTest.CurrentUserOnly.Unix.cs	Adds a regression test asserting the created socket path has user-only permissions.

[Copilot]

SharedServer stores a single listening socket per path, but CurrentUserOnly is only applied when the SharedServer is first created. If the first server for a path is created without CurrentUserOnly and a later one uses it, the file mode will remain permissive; conversely, if the first uses CurrentUserOnly, later non-CurrentUserOnly servers will inherit the restrictive mode. Consider tracking the shared server's current-user-only state and either (1) rejecting mismatched options for the same path, or (2) always enforcing the most restrictive mode (chmod to 0600 when any instance requests CurrentUserOnly, never loosening).