/var/log/journal permission bits improvements

- Don't make /var/log/journal world readable
- Ensure permission bits are (re)set on each system activation with
  explicit chmod call. mkdir -m MODE PATH will only set the permission
  bits if PATH is *created*.
- Set group ownership to systemd-journal