Lock down sensu permissions.


This makes the sensu config permissions more consistent and secure:

* No world-read on sensitive files and dirs. This was already in place with 750 on /etc/sensu, but this makes it wider (and adds dir set-gid for consistency)

* Make files and dirs root owned, so that the sensu processes can no longer write to them. They can still read everything via the 'sensu' group perms.

* Add 'sensu' to the admins_extra_groups grain, which is used by admins-formula (v1.4.0-rc.lpa.1) to enable admins to read the sensu configuration without using sudo.

So two things about this:

1) It won't affect the grains of the running minion which means it won't get added to the groups for all admins until the _next_ highstate.
2) This feels dangerously close to magic at a distance: "Wait why does this value keep going back in the grains?!"