Chef 4373

Add optional client-side key generation when registering. I decided to make this an opt-in change in order to preserve compatibility with 1.X opEC and 10.x OSC. As a follow-up, we should make client-side generation the _only_ behavior in Chef 12.

Needs end-to-end verification against opEC.