Instead of chowning keys to their user/group every time they are sent,
only attempt the chown during send-keys if the user and group both
exist, and again do a chown during activation after the users and groups
have been created.

One result is that if a key and its user and/or group are to be created
in the same `nixops deploy`, the key will first be uploaded and owned
by root:root, then chmod'd, then late in activation the key will be
chowned to the newly created user/group. This includes a node's first
deploy, when it has neither keys nor users/groups.

Another result is that between send-keys and the next deploy (often,
but not necessarily, in the same `nixops deploy`), a key may
have its permissions set as configured, but _not_ be owned by the
configured user/group (instead root:root), which is presumed safe.

fixes #362, fixes #232

If a user service wants to block until `deployment.keys.mysecret` exists
to start up, it can now do so by adding `"mysecret-key.service"` to
its `requires` and `after` lists.

Allow new keys & users/groups to be created in the same deploy