Pull app store password from the keychain

I'm not a huge fan of committing my Apple ID password to a repo, so this change adds a function that pulls the password from a manually created Keychain entry.

If you specify the value in hiera, it'll continue to work as before.  If it's not defined in hiera, it'll hit Keychain to find it. You can create the Keychain entry by running

```
security add-generic-password -a <apple id> -s 'Apple App Store' -T /usr/bin/security -w <password>
```