Fix umask better

While the umask was previously set for builds (and in fact `docker run`
sets it to 0022 by default), the release pipeline `cp`'s files (with
`-a`) which respect the user's umask, and is outside of the build path.

This sets the umask in a common function called by all build tools,
which Stephen agreed was the simplest and most complete fix.  The
`verify-prereqs` function is already poorly named for what it does, and
this only makes it epsilon worse.

build/common.sh

@@ -163,6 +163,9 @@ function kube::build::verify_prereqs() {
 
   kube::version::get_version_vars
   kube::version::save_version_vars "${KUBE_ROOT}/.dockerized-kube-version-defs"
+
+  # Without this, the user's umask can leak through.
+  umask 0022
 }
 
 # ---------------------------------------------------------------------------