Make configure-qpid.sh non-destructive.

 * Sign with certutil instead of openssl

   Using certutil let's us sign with whatever CA is in the Qpid NSS DB,
   instead of having to have the CA cert and key out somewhere in the file
   system.  This situation is mainly of concern when running the script
   where a Qpid CA is already in the NSS DB.

 * Handle duplicates in the NSS DB.
 * Use existing Katello Candlepin certs.
 * Use cert fingerprints for comparison.
 * Use Katello cert alias when appropriate.
We still have to support java6 right? 

keytool -storepass:env STOREPASS
is supported on 7, and would remove password from cli (and ps, etc)