lnd: allow group reading admin macaroon

This changes file reation mode on admin macaroon from 0600 to 0640. The
reason is to make permission management easier.

Closes #4385

**Is this safe?**

Yes, it is. Assuming a reasonably secure Linux system, it will have a
separate group for each user. E.g. a new user `lnd` gets assigned group
`lnd` which nothing else belongs to. A system that does not do this is
inherently broken already.

Since there is no other user in the group, no other user can read admin
macaroon unless the administrator explicitly allowed it. Thus there's no
harm allowing group read.

docs/release-notes/release-notes-0.14.0.md

@@ -5,6 +5,19 @@
 [Return payment address and add index from
 addholdinvoice call](https://github.com/lightningnetwork/lnd/pull/5533).
 
+## Security 
+
+### Admin macaroon permissions
+
+The default file permissions of admin.macaroon were [changed from 0600 to
+0640](https://github.com/lightningnetwork/lnd/pull/5534). This makes it easier
+to allow other users to manage LND. This is safe on common Unix systems
+because they always create a new group for each user.
+
+If you use a strange system or changed group membership of the group running LND
+you may want to check your system to see if it introduces additional risk for
+you.
+
 # Build System
 
 [A new pre-submit check has been
@@ -31,4 +44,5 @@ the release notes folder that at leasts links to PR being added.
 
 # Contributors (Alphabetical Order)
 * ErikEk
+* Martin Habovstiak
 * Zero-1729