STIG: Lock Down Sensitive File Permissions

Someone loosened the permissions on this system's account and config files. Restore them to the DISA STIG baseline so a compliance scan passes: /etc/shadow and /etc/gshadow must give other users no access and their group read at most (0640 or stricter), /etc/passwd and /etc/group stay world-readable but owner-writable only (0644), and the SSH daemon config /etc/ssh/sshd_config is owner-only (0600). Grading reads the actual mode bits, the way OpenSCAP does.