Add a keys group with read access to /run/keys

This allows processes running as unprivileged users access to keys they might need