DOC + ENH:  PFSCodecRegistry will self-test if given keys

- could / should also try-except to see if the basis codec itself works
and catch errors

- some 2to3 fixes and placeholders, almost but not quite there
RF: new base class for SecFile, holds helper methods
RF: only register things at SecFile.__init__

- never call implicitly
RF: use SecFiles within rotate; no pad at init
DOCs + RF: minor changes, test encrypt empty file
BF: relative vs full path names in tar archive
NF: --unpad command line option

easier to remember than '--pad -z 0'
NF: registry self-test if given test_keys

plus:
- BF in is_in_writeable_dir
- ENH is_encrypted tests is_tarfile