[COOK-3379] Generate keystore and restart tomcat only when sources change

Fix a bug that was causing the keystore to be regenerated and tomcat to restart every chef-client run. The fix involves switching from "creates" to "action :nothing" to control when the keystore generation script runs.

This is the second take on the fix, per comments on the Jira ticket.

See http://tickets.opscode.com/browse/COOK-3379