Refactor third-party caveat encoder/decoder to caveatid package.

Remove non-public-key third-party caveatid encoding for now (this can always be added
back later as an alternative implementation of bakery.CaveatId{Encoder,Decoder}).
Updated httpbakery & tests accordingly.
I think I'd unexport this type (and BoxDecoder), and make NewBoxEncoder and NewBoxDecoder return CaveatIdEncoder and CaveatIdDecoder respectively. Then we get a nice sleek package API.