(#22499) Puppet manages owner/group of own vardir

lib/puppet/defaults.rb has :vardir as a directory setting, but did not
specify an owner or group.  If the user/group is changed and puppet is
restarted with a --mkusers setting, vardir will be owned by the previous
user uid, and puppet master will fail to access information under
/var/lib/puppet (if permissions are strict enough).  This first
manifests as an inability to read the ca cert under
/var/lib/puppet/ssl/certs.  (This assumes running puppet master as root,
which will attempt to manage settings as the service user 'puppet' and
then daemonize as puppet).

This change addes :owner, :group settings of 'service' to the :vardir
entry.