Encryption: reduce noise from encryption failures when decrypt=lax
Read-only yum cache

This makes the yum cache read-only so that bcfg2-yum-helper cannot
update the cache on the fly, which should help avoid locking issues
with the yum caches that can cause client runs to fail.  It also makes
the Packages plugin behave more consistently, since use of yum
libraries won't cause the cache to be refreshed at random times on the
fly, but rather more predictably as with the Apt cache or the yum
cache without using yum libraries.  Unlike those two cases, though,
the caches will not all be downloaded initially, but rather
opportunistically as needed.

In order for this to work, the Bcfg2 server must not run as root.
Root ignores the 'w' permissions bit, so the cache cannot be made
read-only.