Expire certs in the agent; Delete direct from agent

This commit includes the agent_client module which introduces a little
bit of code for talking directly to the openssh agent. We use this now
to remove existing keys from a running agent before re-adding them. The
problem before was that ssh-add -d sometimes had trouble finding the
public key to delete. I think we can do a better job of finding the key
and more reliably remove old keys.

The get_cert module also now adds private keys with ssh-add using the -t
option which tells ssh-agent to automatically remove a key after -t
seconds. We set -t to the number of seconds between now and the expiry
of the certificate. Though this means people's ssh keys will be removed
even though only the certificate expired this doesn't seem awful.