ceph: add ensure param to ceph::key

Removing a key is as easy as adding it. Add an ensure parameter and act
on it. While at it, also add docs for the whole definition.

Change-Id: I91ceb378142cb36dc3ccd400e020be4d24691334