Support reading PKCS8 CA keys.

Normally we generate and store a PKCS1 RSA private key for the candlepin CA. In
FIPS environments our setup scripts actually create an unencrypted PKCS8 cert.

Bouncycastle reads both and may return different objects.
Remove use of anon ECDH ciphers in tomcat config, add ECDHE.

Removing ECDH ciphers firstly because they should not be used:

http://wiki.openssl.org/index.php/Diffie_Hellman#Diffie-Hellman_in_SSL.2FTLS

These ciphers are disabled in the default JDK JCE provider, but are actually
implemented if you switch to the FIPS compliant SunPKCS11-NSS, at which point
they may be selected for use.

Secondly, they do not actually work with our application. From the link above,
a call to get peer certificate will return null because we're using an
anonymous protocol. This results in seeing no certificates on the HTTP request
object in Candlepin's SSLAuth class.

We are adding in TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA as this is a preferred
cipher. (see more in link above) This cipher *is* implemented in the default
JCE provider for java 6 and 7 both, and *should* be selected automatically.
(if the client supports it, m2crypto does)
Fix reading PKCS1 server certs.
Merge pull request #530 from candlepin/fips

Allow Candlepin To Run on FIPS server / JVM