According to
https://github.com/NixOS/nixpkgs/issues/147599#issuecomment-1272286679
the bug that prevented this UMask directive from working has been fixed
in systemd, so it should be safe to use now.
This stops paperless-ngx from making everything world-readable on disk,
but it does not change permissions of any files previously created.