Flysystem 1.0 allows us to setup permissions for files it creates.

Permissions can be passed to the Local Adapter constructor, used by ezpublish.core.io.flysystem.default_adapter, in vendor/ezsystems/ezpublish-kernel/eZ/Publish/Core/settings/io.yml:

    ezpublish.core.io.flysystem.default_adapter:
        class: League\Flysystem\Adapter\Local
        arguments:
            - %io_root_dir%

The settings we use should be easily configurable.