Remove unnecessary CA key entry.

Private keys only need a password if they are generated with the
'-des3' (or similar) option in openssl.  Under normal circumstances,
private key PEM files are not encrypted.  This patch removes the
candlepin.ca_key_password configuration entry and corrects the
gen-certs script to indicate more clearly that the CA keys are not being
encrypted.