(SERVER-30) Copy cacert to localcacert and remove from master fail-fast

This commit removes the check for localcacert from the master fail-fast
logic and replaces with a new CA protocol function,
`retrieve-ca-cert!`, which populates the localcacert from cacert.  The
new protocol function separates the certificate generation logic in
`initialize-master-ssl!` from the CA cert acquisition logic, allowing the
latter to be reused sometime in the future.

In the previous commit, master initialization would fail if the master cert
and private key were not present but the localcacert were present.  The
latter is valid, for example, if the master certname is changed sometime
after the server is initially booted.  The new logic more closely
matches the error handling in Ruby Puppet master initialization.
The Ruby Puppet implementation copies over the current `localcacert` with whatever is at `cacert` on each bootup.  Suppose I could change it to fail and be non-backward compatible.  Not sure how big of a problem it would be either way since it seems unlikely these will be different.