fix: make issued certificates readable for unprivileged consumers

The pki directories were created with mode 0700, so cert.pem, chain.pem and fullchain.pem stayed
unreachable for every non root process although they are declared as 0644. That defeats the main purpose of
the role, which is handing a certificate to a service such as nginx or postgres.

The directories are opened up to 0755. To keep that safe, the mode of the private keys is now pinned
explicitly to 0600 instead of relying on the default of community.crypto.openssl_privatekey.

Co-authored-by: Copilot <copilot@github.com>

tasks/root_certificate_authority_unprotected.yaml

@@ -3,6 +3,7 @@
 - name: Create private key for root CA
   community.crypto.openssl_privatekey:
     path: "{{ certificate_authority_root_ca_path }}/privkey.pem"
+    mode: "0600"
     type: "{{ certificate_authority_root_ca_tls_key_type }}"
 
 - name: Create a certificate signing request (CSR) for root CA