expose secret key for initial host provisioning

This addresses the 'chicken-and-egg' problem that @jtimberman alludes to in http://jtimberman.housepub.org/blog/2013/09/10/managing-secrets-with-chef-vault/.  I'm only starting to test this in EC2, but I thought I should submit a PR for feedback sooner rather than later.

## Using Shared Secrets

When instantiating new nodes, you may need to access the vault
with the symmetric key in the same way would with a standard
encrypted data bag, as in the following workflow:

* Save the current vault secret to a file with 'knife encrypt expose key'
* Encode the secret so it's available to node at launch, e.g. userdata.txt for EC2.
* Launch node for initial provisioning, then wipe the secrets file from disk
* Rekey the vault with 'knife encrypt rotate keys'
* Update the vault ('knife encrypt update') with an updated node search so the new node has keys encrypted with its private key.

#### Example Code

Recipe:

```ruby
passwords = ChefVault::Item.load("password", "root", "/etc/chef/vault_secret")
```

And for key management:

```shell
knife encrypt expose key password root --mode client --secret-file vault_secret
# provision node with 'vault_secret'
knife encrypt rotate keys password root --mode client
knife encrypt update password root --search 'role:base' --mode client