Work around keytool err on empty (zero-byte) file

Previously, puppet would give the following keytool error when :target
is an empty file.

    err: /Stage[main]/Pe_mcollective::Ca/Java_ks[puppetca:truststore]/ensure: change from absent to latest failed: Execution of '/usr/bin/keytool -importcert -noprompt -alias puppetca -file /etc/puppetlabs/puppet/ssl/certs/ca.pem -keystore /etc/puppetlabs/activemq/broker.ts -trustcacerts' returned 1: keytool error: java.lang.Exception: Keystore file exists, but is empty: /etc/puppetlabs/activemq/broker.ts

This commit resolves the problem by writing the keystore to a temporary
file, if the target is empty, and then copying the newly generated
keystore into the original target (thus bypassing keytool's reluctance
to interact with empty files).