Don't DES-encrypt priv keys without a passphrase

Per https://www.openssl.org/docs/crypto/pem.html, specifying to encrypt
a private key with DES *without* providing a passphrase causes OpenSSL
to prompt for the passphrase to use on the console -- which is
problematic for GUI applications which generally lack a console.

This modifies the behavior of RSAKeyImpl::save() so that DES encryption
of private keys will not be attempted unless the passphrase argument is
non-empty. This will also suppress OpenSSL's prompting for that
passphrase on the console.

Also added a case to the test suite.
Fix RSAKey constructor documentation.

The two RSAKey constructors which take existing keys (one from a
stream, the other from a string) have incomplete and ambiguous
documentation.

This change improves the header documentation to reflect that:
 1. Decryption is supported using a private key (existing doc says you
    can "only" sign if a private key is present),
 2. Clarify that public key not needed when private key is present.