Set lenient group permissions on /shadow data

Addresses:
tpo/tpa/team#40476 (comment 2762378)
10 jobs for !11 with group-permissions in 9 seconds (queued for 55 seconds)
latest merge request