(PUP-1120) Be explicit about group for ssl directory

Previously, files and directories contained with the `ssl` directory
were inconsistent with respect to their `group`. For example, the
`certs` directory had group `root`, but files within it,
e.g. hostname.pem, had group `service`.

Commit c6846c2b updated the `hostprivkey` and `privatekeydir` settings
so that they are readable by the `service` group. This commit makes
the `service` group explicit for other files & directories in the
`ssl` directory.
(PUP-1120) Remove group write permission for ca settings

Previously, the `service` group was granted write permission for ca
related files, but that is not necessary and likely left over from a
time when puppet did not manage the group correctly for file settings.

This commit removes group write permission for ca settings.