allow string content to be added directly to archiver
added PrivateKeyWrapper.deriveWrapper
modified JcaPrivateKeyWrapper.getContent to use proper ASN.1 structure

Even the resulting PEM-encoded key was recognizable to OpenSSL, the
ASN.1 structure wasn't quite right, so "openssl rsa -check" would
complain.
CredentialExporter now gets decrypted private key as an argument
fixed problem PemArchiveExporterTest
added CredentialProtectionService, implementation, and tests
allow credential component content to be fetched as a string
credential private key is now decrypted before export
added password entry to Export Credential interaction
declare nbsp entity in passwordForm component