vcsh: Initialize repos with --shared=0600

Configurations and other dotdir content may be highly confidential.

Ensure we're not leaking/exposing information by making vcsh
repositories user-accessible, only.

Thanks to Enrico Zini for realizing this was a problem.