Lock down sensu permissions.


This makes the sensu config permissions more consistent and secure:

* No world-read on sensitive files and dirs. This was already in place with 750 on /etc/sensu, but this makes it wider (and adds dir set-gid for consistency)

* Make files and dirs root owned, so that the sensu processes can no longer write to them. They can still read everything via the 'sensu' group perms.

* Add 'sensu' to the admins_extra_groups grain, which is used by admins-formula (v1.4.0-rc.lpa.1) to enable admins to read the sensu configuration without using sudo.

Hmmm. It isn't the cleanest solution, i appreciate. I don't like that it (lightly, admittedly) couples sensu-formula to a concept in admins-formula.

In this particular instance, becoming available on the next highstate isn't something that's hugely problematic, but I can understand that minimising the need for re-runs is desirable.