SECURITY-831 Support external password for keystore of PicketBoxVault implementation

Includes also backports of related issues, see SECURITY-832 and SECURITY-833.