(PUP-1451) Make SSL file permissions a bit more relaxed for public files
(PUP-1120) Make modes of public ssl directories explicit

Previously, the mode of the `certs`, `public_keys`, and
`certificate_requests` directories within the `ssl` directory was
unspecified. This means the actual mode depended on the umask of the
user that started puppet, and caused those directories to be created.

Since the information in these directories is intended to be public,
there is no harm in making the mode explicit 0755. This also matches
what I see when installing puppet from packages.
(PUP-1120) Be explicit about group for ssl directory

Previously, files and directories contained with the `ssl` directory
were inconsistent with respect to their `group`. For example, the
`certs` directory had group `root`, but files within it,
e.g. hostname.pem, had group `service`.

Commit c6846c2b updated the `hostprivkey` and `privatekeydir` settings
so that they are readable by the `service` group. This commit makes
the `service` group explicit for other files & directories in the
`ssl` directory.
(PUP-1120) Remove group write permission for ca settings

Previously, the `service` group was granted write permission for ca
related files, but that is not necessary and likely left over from a
time when puppet did not manage the group correctly for file settings.

This commit removes group write permission for ca settings.
(PUP-1451) (PUP-1120) Merge branch 'relaxed_permissions'