Refactor third-party caveat encoder/decoder to caveatid package.

Remove non-public-key third-party caveatid encoding for now (this can always be added
back later as an alternative implementation of bakery.CaveatId{Encoder,Decoder}).
Updated httpbakery & tests accordingly.
This makes me uncomfortable - there's now no constructor for a Discharger
other than Service.Discharger.

Rather than having an unexported field here, how about removing the Discharger entirely?

While investigating the viability of this, I ended up actually doing it; the result
is in cmars-003-caveatid-pkg in rogpeppe/macaroon (I rebased, I'm afraid,
after merging some changes I made to use the updated jsonhttp API).