Encrypt catalog at rest

The puppet cached catalog file contains a lot of high value content.  The system admin may not do as great a job protecting it as the content being managed.  This is even more vulnerable when running the agent as a non-privileged user.

Having the cached catalog encrypted with the host's public key would provide a minimal level of protection against plain text exposure.