Make the runtime-generated app image read-only

Make the app image (.art file) generated at runtime by
RuntimeImage::WriteImageToDisk read-only (permissions 0444)
once it is successfully written and moved to its final path.
There is no need to keep the file writable once it is done,
and making it read-only helps prevent tampering.

If we fail to make the image read-only, we discard the image
by deleting it and returning an error to ensure we don't leave
a writable image behind.

Bug: 489675413
Test: atest art_standalone_runtime_tests
Flag: EXEMPT BUGFIX
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:a18d72596e17970c975ea556cba1901a2ec721bf
Cherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:b61e34ca43ef0e47d6596cd7e7ea9c8632391a30
Merged-In: If93791db692fb4e15fb322bf0a5c2cc5299384c4
Change-Id: If93791db692fb4e15fb322bf0a5c2cc5299384c4