nixos/prometheus: allow state access for service only

There is no reason for Prometheus state files to be
world-readable.

nixos/modules/services/monitoring/prometheus/default.nix

@@ -945,6 +945,7 @@ in {
         RuntimeDirectoryMode = "0700";
         WorkingDirectory = workingDir;
         StateDirectory = cfg.stateDir;
+        StateDirectoryMode = "0700";
       };
     };
   };