Refactor third-party caveat encoder/decoder to caveatid package.

Remove non-public-key third-party caveatid encoding for now (this can always be added
back later as an alternative implementation of bakery.CaveatId{Encoder,Decoder}).
Updated httpbakery & tests accordingly.
This seems a bit smoke-and-mirrorsy. :)
Have we any particular reason to believe that
the private key isn't already splattered in many
places in memory?

Also:

  key.private = Key{}

(or if Key isn't defined:

    key.private = [KeyLen]byte{}
)
would probably be a slightly better here