Readd password protected private key support

If passfile exists when puppet starts for the first time, then it will encrypt its private key using 3DES-CBC. However, the current implementation is a bit dubious. If puppet tries to load an encrypted private key and the passfile does not exist, then ruby will hang due to openssl prompting for the password. Ruby uses the legacy PEM_write_* methods that only use 1 iteration. Per https://www.openssl.org/docs/man1.0.2/crypto/pem.html "The encryption key is determined using EVP_BytesToKey(), using salt and an iteration count of 1" and https://github.com/ruby/openssl/issues/13. Also puppetserver does not support password protected private keys, so it can't be enabled on server hosts.