Fix #2: add options to encrypt all private keys

This is a backwards-incompatible change.

The --password argument to certified-ca(1) is now --root-password.
--intermediate-password has been added to encrypt the intermediate CA's
private key.  --encrypt-intermediate may be used to encrypt the
intermediate CA's private key by password entry.

The --password argument to certified(1) now applies to the private key
of the certificate being generated.  This private key may also be
encrypted by password entry with the --encrypt option.  The
--ca-password argument now applies to the CA private key.

certified-csr(1) now accepts --password and applies it to the private
key it generates.  It also accepts --encrypt to encrypt the private key
by password entry.

certified-crt(1) now accepts --ca-password instead of --password.
Mac compatibility, mostly

There's still a dependency on GNU sed(1) in certified-crt(1).