Use chef_secrets & veil throughout push-server

[stevendanna]

We've moved all passwords and keys into the veil-managed secrets store at /etc/opscode/private-chef-secrets.json. This helps ensure that we don't write out passwords to more files than we need to.

Existing installs are automatically migrated to the new credentials system on reconfigure.

TODO:

• [x] Sort out /etc/opscode/private-chef-secrets.json permissions, see TODO in code.
• [x] chef_authn bug likely causing most of our pedant failures: https://github.com/chef/chef_authn/pull/30
• [x] Pedant is still using pivotal.pem from disk, I think the relevant code is actually in chef-server.
• [x] ~Writing to /etc/opscode/private-chef-secrets.json using a "group" that doesn't already exist in chef-server creates a compatibility break since the older chef-server code tries to write these into node attributes and the top level group needs to be pre-filled with a hash. That is it breaks here https://github.com/chef/chef-server/blob/master/omnibus/files/private-chef-cookbooks/private-chef/libraries/private_chef.rb#L501 if you aren't use a key created up here: https://github.com/chef/chef-server/blob/master/omnibus/files/private-chef-cookbooks/private-chef/libraries/private_chef.rb#L50~ (Fixed via WONTFIX)