`getrawchangeaddress` should fail when keypool exhausted

An user on IRC reported an issue where `getrawchangeaddress` keeps returning a single address when the keypool is exhausted. In my opinion this is strange behaviour.

- Change CReserveKey to fail when running out of keys in the keypool.
- Make `getrawchangeaddress` return RPC_WALLET_KEYPOOL_RAN_OUT when unable to create an address.
- Add a Python RPC test for checking the keypool behaviour in combination with encrypted wallets.

The other uses of CReserveKey::GetReservedKey are:
- In `CWallet::CreateTransaction`: right after unlocking the wallet, so no problem
- In the internal miner in `CreateNewBlockWithKey`: the miner thread will exit when it cannot reserve a key. In This can happen with an encrypted wallet when the keypool is exhausted. As the internal miner is only used for testing, I think we can live with this.
BTW I was a bit surprised here; I do a keypoolrefill(3), but it needs to request four keys to exhaust the pool. Not sure yet why.