Ensure that a keystore intended for a keymanager has private keys

When using client authentication, the key store must contain private keys.  JSSE does not do a very good job at communicating this, and so this patch iterates through the key manager's keystore and logs warnings if an entry is found without a private key, and logs an error if no private key is found. 

It does not throw exceptions or terminate early, as the TLS handshake will still work fine if even if the keystore is misconfigured if the server does not use client authentication.
I think so, because the issue is that the client could potentially do client authentication to many different servers, and so have many aliases.  If only one of them is missing a private key (unlikely, but possible), then we wouldn't error, and they'd be confused when authentication failed (ngnix just gives you a 400 and says you are missing a required key, and aliases don't always correspond to the relevant serverAltName/DNS entry in the X.509 certificate).