Implement syncing of encryption keys from vault to store

 * Move most of the encryption key types and key derivation logic
   from onepass to key_agent so that it can be used in both
   the local item store and the vault.

 * Make the vault and the local store share a key agent so that
   once the keys have been unlocked either via vault.unlock()
   or store.unlock(), items can be synced between the stores
   since both will be unlocked.

 * Add method to sync.Syncer to sync keys from the vault to the local
   store

 * In web UI setup, kick off a sync of encryption keys as soon as
   the vault is ready.