REL-1564 Valid OT keys must persist across OT/ODB updates. 

The solution is to make the `auth.ser` keychain file a "permanent" data file using the facility Florian (I think) added to the existing `ExternalStorage` trait. I assume that the `.gemini` permanent storage root on the Telops machines is a blessed link to `~/perm/.gemini` ... if not we need to set that up (for this and for QV).

While I was in there I fixed a design oddity in `ExternalStorage`; this will be easier to review if you look at the commits individually.

**Note** that this means the keychain will be preserved across OT updates starting not this coming semester, but the next.

**Note** also that this assumes the keyserver storage is copied over when the SPDB is upgraded. A facility to manage this automatically is pending with REL-1538.