Refactor third-party caveat encoder/decoder to caveatid package.

Remove non-public-key third-party caveatid encoding for now (this can always be added
back later as an alternative implementation of bakery.CaveatId{Encoder,Decoder}).
Updated httpbakery & tests accordingly.
It's not foolproof -- this key came from somewhere, possibly read from a file or database, the pointer to it is available, etc. -- but still, the API consumer might find it useful to 'defer Zeroize' to have one less copy to keep track of.

I feel some responsibility to at least provide a way to forget private key material that my code holds onto.

That said, do you think Go even handles zeroization as I'm intending? I've read that C compilers like to optimize such functions away, in http://www.daemonology.net/blog/2014-09-04-how-to-zero-a-buffer.html. Hoping that Go's complier is more transparent and trustworthy.