(SERVER-30) Copy cacert to localcacert and remove from master fail-fast

This commit removes the check for localcacert from the master fail-fast
logic and replaces with a new CA protocol function,
`retrieve-ca-cert!`, which populates the localcacert from cacert.  The
new protocol function separates the certificate generation logic in
`initialize-master-ssl!` from the CA cert acquisition logic, allowing the
latter to be reused sometime in the future.

In the previous commit, master initialization would fail if the master cert
and private key were not present but the localcacert were present.  The
latter is valid, for example, if the master certname is changed sometime
after the server is initially booted.  The new logic more closely
matches the error handling in Ruby Puppet master initialization.
Yeah, I put the copy/restore in just in case we wanted to add new tests to the block under the current one -- in hopes that the cacert would be preserved.  I could add a step to validate that no file was created at `localcacert` and add a `fs/delete localcacert` for safety at the end...