(SERVER-30) Copy cacert to localcacert and remove from master fail-fast

This commit removes the check for localcacert from the master fail-fast
logic and replaces with a new CA protocol function,
`retrieve-ca-cert!`, which populates the localcacert from cacert.  The
new protocol function separates the certificate generation logic in
`initialize-master-ssl!` from the CA cert acquisition logic, allowing the
latter to be reused sometime in the future.

In the previous commit, master initialization would fail if the master cert
and private key were not present but the localcacert were present.  The
latter is valid, for example, if the master certname is changed sometime
after the server is initially booted.  The new logic more closely
matches the error handling in Ruby Puppet master initialization.
It does seem unlikely, but it also seems better to force a user to resolve it instead of just overwriting a cert.