CVE-2024-27134: MLflow's excessive directory permissions allow local privilege escalation

The vulnerability stems from the directory permission change in _create_model_downloading_tmp_dir() shown in the commit diff. The original 0o777 permissions allowed any local user to modify the temporary model directory. When combined with Spark UDF execution timing, this created a race condition window for privilege escalation. The patch explicitly reduces permissions to 0o770 to mitigate this. The function's direct involvement in Spark UDF workflows and the security-focused nature of the permission change confirm its role in the vulnerability.