ipa_client

On Fedora 41 and later, sssd.conf (and the rest of the contents of
/etc/sssd/) should be group readable, which is enforced by ExecStartPre
entries in sssd.service. Letting Puppet manage the file using incorrect
permissions would cause the sssd service to be restarted every puppet
run.

On other operating systems (such as el8), the file being group readable
is considered too broad, causing permission checks to fail on startup,
and in turn causing the service to fail.

Also strip the executable bit, which should not have been set at all.