(PUP-1120) Stop pretending other can read CA files

The `cadir` setting controls permissions on the `ca` directory. It
sets permissions to service:service and mode 0770.

    :cadir => {
      :default => "$ssldir/ca",
      :type => :directory,
      :owner => "service",
      :group => "service",
      :mode => 0770,

Previously, the permissions for subdirectories and files made it
appear as though `other` could read/traverse, when in reality they
cannot due to permissions on the `ca` directory.

    # tree -p /var/lib/puppet/ssl
    /var/lib/puppet/ssl
    +-- [drwxrwx---]  ca
    |   +-- [-rw-rw-r--]  ca_crl.pem
    |   +-- [-rw-rw----]  ca_crt.pem
    |   +-- [-rw-rw----]  ca_key.pem
    |   +-- [-rw-r--r--]  inventory.txt
    |   +-- [drwxrwx---]  private
    |   |   +-- [-rw-rw----]  ca.pass
    |   +-- [drwxr-xr-x]  requests
    |   |   +-- [-rw-r-----]  arcturus.local.pem
    |   +-- [-rw-r--r--]  serial
    |   +-- [drwxrwx---]  signed
    |       +-- [-rw-r-----]  puppetmaster.solar.lan.pem

Note `ca_crl.pem` has mode 0664; `inventory.txt` has 0644; `requests`
has 0755, and `serial` has 0644.

This commit cleans up the file permissions so that they are
consistently 0660 for files (where `service` is both owner and group),
and 0770 for the `requests` directory.
(PUP-1120) Be explicit about group for ssl directory

Previously, files and directories contained with the `ssl` directory
were inconsistent with respect to their `group`. For example, the
`certs` directory had group `root`, but files within it,
e.g. hostname.pem, had group `service`.

Commit c6846c2b updated the `hostprivkey` and `privatekeydir` settings
so that they are readable by the `service` group. This commit makes
the `service` group explicit for other files & directories in the
`ssl` directory.
(PUP-1120) Make modes of public ssl directories explicit

Previously, the mode of the `certs`, `public_keys`, and
`certificate_requests` directories within the `ssl` directory was
unspecified. This means the actual mode depended on the umask of the
user that started puppet, and caused those directories to be created.

Since the information in these directories is intended to be public,
there is no harm in making the mode explicit 0755. This also matches
what I see when installing puppet from packages.
(PUP-1120) Remove group write permission for ca settings

Previously, the `service` group was granted write permission for ca
related files, but that is not necessary and likely left over from a
time when puppet did not manage the group correctly for file settings.

This commit removes group write permission for ca settings.