v1.3.6

v1.3.6

• The shipped user unit now runs under UMask=0077 inside a ProtectSystem=strict plus
  ProtectHome=read-only sandbox whose only writable paths are the two service directories
  and the runtime dir, so status.json and the control socket stop being world-readable.
  systemd-analyze --user security librepods.service goes from 9.4 UNSAFE to 3.6 OK.
• The daemon sets both modes itself, on the open temporary rather than on the final path,
  so a manual launch under the default umask is covered too, and it refuses to publish the
  state file rather than leaving the AirPods identity at the wrong mode. Fixes #37, reported
  by @lbonvarl.