Simplify re-encrypt logic

Want to introduce the ability to decrypt with an arbitrary key so we can convert from one v2_key to another. First step is to simplify the recrypt chain.

- separate auth_model_spec and auth_config_model_spec
- consolidate fix_auth#hardcode logic with recrypt logic


https://bugzilla.redhat.com/show_bug.cgi?id=1159009

/cc @jrafanie @Fryguy 
Here, I think the :typ is important but not the bad/good password part.   It seems confusing to mix the :typ and bad/good password differences.  In other words, I think we need a good password value for 'vmdb' and 'event_handling'.  Having the bad and good password values here is confusing to me.