Change the mode on the file descriptor instead of the filename

Also move the permission change time to just after tempfile creation.

This should prevent a race condition and also
reduce the likelyhood that the original file
was removed or replaced by another file
with different permissions.

Suggested-by: @anarcat
Suggested-in: https://github.com/untitaker/python-atomicwrites/issues/42#issuecomment-488669246