(SERVER-30) Copy cacert to localcacert and remove from master fail-fast

This commit removes the check for localcacert from the master fail-fast
logic and replaces with a new CA protocol function,
`retrieve-ca-cert!`, which populates the localcacert from cacert.  The
new protocol function separates the certificate generation logic in
`initialize-master-ssl!` from the CA cert acquisition logic, allowing the
latter to be reused sometime in the future.

In the previous commit, master initialization would fail if the master cert
and private key were not present but the localcacert were present.  The
latter is valid, for example, if the master certname is changed sometime
after the server is initially booted.  The new logic more closely
matches the error handling in Ruby Puppet master initialization.
Are we sure this is the best behavior here?  Perhaps it's better to just fail if the master already has a cert in place at `localcacert` that differs from `cacert`?  What does the ruby CA do in this case?