deploy: Let archipelago run as synnefo:synnefo

Currently archipelago can runs as non root (archipelago:archipelago
by default). Synnefo conf files are shipped as root:www-data for
security issues. There is a known bug in gunicorn that does not set
supplementary groups when changing uid [1]. Therefore gunicorn
should run with group www-data. In order Pithos and Cyclades to be
able to work with archipelago gunicorn must run with the same user.
Let this user be synnefo, the one that snf-common adds upon
installation.

In short make archipelago run as synnefo:synnefo, gunicorn
as synnefo:www-data, and snf-dispatcher as www-data:www-data

Since we are using NFS we create synnefo group with common
gid across all nodes. The archipelago dir to be exported
will be root:synnefo.

Due to a bug in archipelago [2] we chown /dev/shm/posixfd after
archipelago restart.

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=762448
[2] https://github.com/grnet/archipelago/pull/44

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>
docs: Mention the synnefo group in upgrade notes

Synnefo will run as www-data:synnefo while archipelago as
archipelago:synnefo. Mention the changes that should be
made after package installation wrt mods and permissions.

Signed-off-by: Dimitris Aragiorgis <dimara@grnet.gr>