'nogroup' ownership of files in sites/

http://drupal.org/node/327888 hilighted the sensitive issues surrounding the permissions around the files in the platform.

I *think* things are mostly fine now: settings.php files are readable only by the webserver, provision.settings.php is readable only by hostmaster. However, the files in sites/ are generally owned by the 'nogroup' group which is wrong. It should probably be the 'hostmaster' group instead.

Also, if all settings.php files are owned by the www-data user, then sites can read each other's database settings and that's an issue, so even the 'www-data' ownership is an issue, even if it's a seperate issue.