Improve setting permissions on /run/keys.

We had NixOS/nixpkgs@4ab5646417e3cc606281f71027c12ddced8b65b4 so far which introduced the `keys` group in order to theoretically make it possible to allow access to other users than root, practically for NixOps we need to make sure we're allowing access to the group as well.

So, right now it's only setting the group ownership for `/run/keys`, but I'd go even further into changing `deployment.keys.*` into a nested attribute set, which would look like this:

```nix
deployment.keys.foobar = {
  text = "blah";
  user = "someuser";
  group = "somegroup";
};
'';
```

Which then sets the appropriate permissions on the key itself. Unfortunately this will break backwards-compatibility, so I'm waiting for better ideas/suggestions before implementing it that way.

Latest eval at: https://headcounter.org/hydra/jobset/nixops/keys-permissions/latest-eval?filter=tests