prometheus: Make alertmanager.yml only readable by root and alertmanager

It contains secrets, so it shouldn't be world readable.

roles/prometheus/tasks/main.yml

@@ -16,7 +16,7 @@
   notify: reload prometheus
 
 - name: install alertmanager configuration
-  template: src=alertmanager.yml.j2 dest=/etc/alertmanager/alertmanager.yml owner=root group=root mode=644
+  template: src=alertmanager.yml.j2 dest=/etc/alertmanager/alertmanager.yml owner=root group=alertmanager mode=640
   notify: reload alertmanager
 
 - name: enable prometheus server service