Fix SSL cert and key permissions

It is bad practice to use 644 on a private key so we
have migrated the key mode to 0400. The cert is already
avaliable publicly through nginx so we have allowed it
0444.

Nothing should need to write either the cert of the key
after puppet has run, so we have denied any writing.