s4-provision: fix permissions on generated DNS zone file