firstboot: change /etc/shadow access mode to 000

It appears to be customary to remove all access bits from /etc/shadow
including those for the root owner), hence let's do the same.