Give OCG admins the ability to run things as OCG

/usr/bin/nodejs-ocg is the apparmor protected version of
node. It should be safe to allow an OCG admin to run
things under this process.

The use case is actually to give an ocg admin the ability
to execute the maintenance scripts under
/srv/deployment/ocg/ocg/mw-ocg-service/scripts which need
to be able to read /etc/ocg/mw-ocg-service.js

Change-Id: I6d27a8a3cb366f1dfdfa83cceb38d63e404aa0b9
Merge "Give OCG admins the ability to run things as OCG" into production