Handle PEM privkeys that aren't represented as KeyPair objects

Bouncycastle parses puppet-generated PEM private keys as KeyPair objects
with a nil public key. However, it parses PEMs generated by other tools
(like freeIPA) as PrivateKey objects. This patch fixes up our PEM
loading code to handle both cases.
Merge remote-tracking branch 'origin/1.5.x'

Conflicts:
	src/com/puppetlabs/puppetdb/http/v3/resources.clj
	src/com/puppetlabs/puppetdb/query/resources.clj
Merge pull request #708 from grimradical/ssl-privkey-fix

Handle PEM privkeys that aren't represented as KeyPair objects
(#21083) Adding insert/update/delete logic to replace-facts!

Previously when facts for a certificate were replaced, all previous
facts for that certificate name were deleted and all new facts were
inserted. Now existing facts are updated, old facts (no longer present)
are deleted and new facts are inserted.
Minor docstring changes
Moved the in-clause function from scf/storage to jdbc
Added a docstring to scf.storage/insert-facts!
Pushed down the timestamp checking of the fact metadata table. Changed
the isolation level of replace-facts! to ensure there are no
silent write/write failures when there are two replace-facts! commands
running concurrently for the same node. In that scenario, a potentially
older set of facts could overwrite a newer set of facts. Added a test
with an example of that scenario to ensure it's covered.

Moved the transaction for replace-facts! up to command.clj as you can't
change the transaction isolation of an already running transaction.
Fixed a bug when replacing facts has only new facts (no existing facts changed)
caused an NPE, also added a test where no facts were changed
Moved the concurrent fact updating test up a level to the command tests.
This is needed now that the repeatable read isolation happens at a higher level
(in the command execution).
Added a with-transacted-connection' that allows specifying transaction
isolation level right after getting the connection, the existing
with-transacted-connection uses the same code and uses the JDBC
default isolation level