Make config files owned by root:heat, instead of heat:root

We don't want the heat user to be able to write the files.