Avoid TOCTOU in linenoiseHistorySave

[disconnect3d]

Before this commit the linenoiseHistorySave performed fopen(filename, ...) and chmod(filename, ...) and this creates a time of use vs time of check vulnerability.

I have not checked whether this can be exploited, but the fix is trivial here: we can just use fchmod with the opened file descriptor and this is what this commit changes :).

Btw this was found with https://codeql.github.com/ and its https://codeql.github.com/codeql-query-help/cpp/cpp-toctou-race-condition/ rule when scanning a bigger project that used linenoise as a dependency.

[simkca]

Hello,

We have reviewed this pull request as part of a security assessment and confirmed that the issue it describes has security implications. It has now been assigned a CVE ID:

CVE-2025-9810: TOCTOU race in linenoiseHistorySave() allows local attackers to overwrite arbitrary files and change permissions via a symlink attack.

Summary:
linenoiseHistorySave() opens the history file with fopen("w") and later calls chmod() on the same path. An attacker can race a symlink between these operations: first pointing it to a sensitive file at open, then switching it before chmod. This results in arbitrary file overwrite or permission changes. Downstream consumers (e.g., redis-cli) are affected as well.

Impact:
Arbitrary file overwrite with process privileges
Unintended permission changes on unrelated files
History file confidentiality bypass