admins_extra_groups grain for adding groups to admin accounts

This allows formula to insert their group into the list of groups that admin users are members of.

This in turn then means that we can start to use '2750' permissions on config directories, which makes the system more secure but doesn't annoy us when diagnosing problems, since we can happily read the configs and list directories without using sudo