Refactor third-party caveat encoder/decoder to caveatid package.

Remove non-public-key third-party caveatid encoding for now (this can always be added
back later as an alternative implementation of bakery.CaveatId{Encoder,Decoder}).
Updated httpbakery & tests accordingly.
The way to forget private keys is to let the garbage collector deal with them - it
zeros everything as soon as it can. I think that pretending we can destroy information
like this is complicating our code for no useful benefit. I like to take my cue
from Adam Langley (the main crypto guy on the Go team) for things like this,
and he doesn't provide similar methods in any of the crypto packages he's produced.

Also, *k = KeyPair{}, will do the job if you really want to.