GHSA-x6ph-r535-3vjw apko is vulnerable to attack through incorrect permissions in /etc/ld.so.cache and other files

• Go chainguard.dev/apko: >= 0.27.0, < 0.29.5 → fixed in 0.29.5

It was discovered that the ld.so.cache in images generated by apko had file system permissions mode `0666`: ``` bash-5.3# find / -type f -perm -o+w /etc/ld.so.cache ``` This issue was introduced in commit 04f37e2 ("generate /etc/ld.so.cache (#1629)")(v0.27.0). Impact This potentially allows a local unprivileged user to add additional additional directories including dynamic libraries to the dynamic loader path. A user could exploit this by placing a malicious library in a directory they control. Patches This issue was addressed in apko in aedb077 ("fix: /etc/ld.so.cache file permissions (#1758)") (v0.29.5). Acknowledgements Many thanks to Cody Harris from H2O.ai for reporting this issue.