keyholder: add /etc/keyholder.d and `keyholder arm` subcommand

* Make it easier to get the file permissions right when provisioning a private
  key for use with keyholder by having an /etc/keyholder.d directory that is
  owned by root:keyholder and has mode 0750 and by having a
  keyholder::private_key resource that provisions private key files there.
* Add a `keyholder arm` subcommand that adds keys in /etc/keyholder.d to the
  agent.

Change-Id: Ia8da897db1e2a54926f8eaec0984b7b925dc6fea