Set certs and files with kubeadm token to mode 0640 (#5325)

Change-Id: I298496e55a6889c158b2085fcadeda5e679a873e

roles/kubernetes/master/tasks/kubeadm-migrate-certs.yml

@@ -3,6 +3,7 @@
   copy:
     src: "{{ kube_cert_dir }}/{{ item.src }}"
     dest: "{{ kube_cert_dir }}/{{ item.dest }}"
+    mode: 0640
     remote_src: yes
   with_items:
     - {src: apiserver.pem, dest: apiserver.crt}