Add removal of old cert file to install
Add stub MCollective agent
Convert back to specifying full ca cert

This is in order to enable dropping the $ssldir/certs/ca.pem file when
performing key switchover. Otherwise, there get to be serious
complications switching over agents using Puppet, since the next time
the Puppet agents run they'll redeploy the old ca cert. Once a puppet
agent has a ca cert it thinks it knows who it's supposed to be trusting
and won't re-download a new copy.
Refactor module into agent and ca roles

The rekey::ca role can be applied to automatically generate and
optionally install a new ca. The rekey::agent class can be applied to
automatically generate and optionally install new keys and certificates.
Make agent install dependent on signed cert

Assume the signed cert will be retrieved from the master prior to
installing the new key. The reason for this requirement is that if a
cert doesn't exist, an agent will automatically request one from the
master. If the master gives it a cert signed by the old CA, the agent is
effectively disabled and cannot resume until manual intervention removes
the conflicting key and/or certificate. Therefore, don't install the key
unless the certificate is also available and can be installed at the
same time.
Add better class header comments

So that things look consistent in the PE Console
Clear some tunables from agent

Update the rekey::agent class to assume that the CA cert is
auto-generated, or at least available in the module's var dir on the
master.