Moved the tomcat role above the idp role

The tomcat role has now been moved above the idp role, as the tomcat
role sets the stage for certain tasks in the idp role.
Added task to change permissions of shibboleth-idp

The directory /opt/shibboleth-idp should now be placed in the tomcat
group and have only read, write and execute permissions for only the
root user, and only read and write permissions for everyone else. This
should ensure security.