Make keystone.conf owned by root:keystone, instead of keystone:root

We don't want the keystone user to be able to write the file.

Also, don't have keystone own directories it doesn't need to own.