Lock down sensu permissions.


This makes the sensu config permissions more consistent and secure:

* No world-read on sensitive files and dirs. This was already in place with 750 on /etc/sensu, but this makes it wider (and adds dir set-gid for consistency)

* Make files and dirs root owned, so that the sensu processes can no longer write to them. They can still read everything via the 'sensu' group perms.

* Add 'sensu' to the admins_extra_groups grain, which is used by admins-formula (v1.4.0-rc.lpa.1) to enable admins to read the sensu configuration without using sudo.