Allow specifying the user who owns the config file
Install config file as owned by sshd:root instead of root:root

This is what the Ubuntu package does and is what is necessary for the login_duo
command to be able to read the file.