[13.x] Validate key files' permissions (#1789)

* validate key permissions

* oauth2-server handles Windows

src/Passport.php

@@ -20,7 +20,7 @@ class Passport
     /**
      * Indicates if Passport should validate the permissions of its encryption keys.
      */
-    public static bool $validateKeyPermissions = false;
+    public static bool $validateKeyPermissions = true;
 
     /**
      * Indicates if the refresh token should be revoked after use.

src/PassportServiceProvider.php

@@ -255,7 +255,7 @@ protected function makeCryptKey(string $type): CryptKey
             $key = 'file://'.Passport::keyPath('oauth-'.$type.'.key');
         }
 
-        return new CryptKey($key, null, Passport::$validateKeyPermissions && ! windows_os());
+        return new CryptKey($key, null, Passport::$validateKeyPermissions);
     }
 
     /**