deprecate: signed/verified units

The signed/verified units functionality still works, but nasty
warnings are logged to stderr.

Fix #671
etcd: enable SSL Certificate authentication

Provide TLS configuration when SSL certificate authentication is enabled in etcd endpoints.
Add configuration option for keyfile, certfile and cafile on both fleet and fleetctl.
pkg: accept initial values in New*Set functions
unit: implement FakeUnitManager.GetUnitStates
registry: fill in more FakeRegistry methods
agent: rename AgentState to AgentCache
agent: unexport UnitStatePublisher.PublishAll
agent: use AgentReconciler model to drive Agent
functional: wait 15s for active units

The new agent reconciler slows things down a bit. The functional
tests reliably fail with 10s, and pass with 15s.
agent: simplify agentCache down to bare minimum
functional tests: add capabilities for ntpd
Merge pull request #712 from jonboulle/func

functional tests: add capabilities for ntpd
registry: add UnitHash to published UnitStates

This introduces a new field in UnitStates containing the string
representing the Hash of the associated Unit, to disambiguate between
UnitStates published with the same name but actually representing
different Units.

To facilitate this, the systemdUnitManager maintains a synchronized map
to track the hashes of the units it loads/unloads.
systemd: lock for entire GetUnitStates call
Merge pull request #700 from jonboulle/unithash

registry: add UnitHash to published UnitStates
engine: no purge on loss of etcd

Partial fix for #708
Merge pull request #711 from bcwaldon/708

engine: no purge on loss of etcd
agent: tweak UnitStatePublisher logs
Merge pull request #713 from bcwaldon/tweak-logs

agent: tweak UnitStatePublisher logs
Merge pull request #677 from Deliverous/master

Enable SSL Certificate authentication for etcd endpoint