fix(security): isolate temporary scratch directory per user and restrict permissions

[ZhuchkaTriplesix]

Summary

• Isolated scratch/shadow directory per effective user UID (/tmp/clickhouse-query-ext-<uid>/shadow or via XDG_RUNTIME_DIR)
• Configured directory creation mode strictly to 0700 (rwx------) preventing unauthorized local access
• Validated directory ownership matches current process EUID and actively rejected insecure symlinks
• Added unit tests for directory creation permissions, ownership, and symlink rejection

Closes #55