Set secrets directory permissions to 701

[troyfigiel]

This PR ensures users that own secrets can read them if they are not the remote SSH user.

• I would suggest replacing 700 permissions by 701 permissions. Execute permissions are necessary and sufficient for the user to access secrets they own. Adding a keys group makes things more complicated with little benefit, since 710 permissions will still be necessary.
• I do not use the home-manager module, but I assume the same problem arises here, since you use umask 077. Changing that to umask 076 when creating the parent directory should do the trick.
• Note that the install command actually creates any non-existing parent directories with 755 permissions, not with the permissions set by the -m option. This might not be what you actually want and I would recommend changing to to a umask and mkdir like you did before.

[troyfigiel]

I checked for my own servers by the way:

• If I create a nested secret by using root to deploy a lollypops secret, my own non-root user can now read that secret fine
• Setting sudo.enable = true and sudo.opts = [ "-E" ] (random example) still works fine meaning the command is not malformed

In other words, seems to work fine for me at least :)