this wasn't propagating to localclient as expected; error stacks can't
be wrapped in enc/load envelope.

the end goal of this work is to support a non file/disk based interface
for pub key management. Using the existing salt.cache interface allows
us to leverage existing implementations of other storage backends (ie
mysql, postgres, redis, etc). Of note, this will allow a common shared
view of pub keys for multi-master setups.

To avoid a break-the-world scenario in this change, a fully backward
compatible salt.cache.localfs_key_backcompat is provided as the new
default that emulates the disk operations salt.key was doing before.

open discussion items:
- as is i've left master side pub/priv key as is to live in
  etc/salt/pki; it COULD be moved to the same interface if thats desired

this is a continuation of the previous commit where the 'open discussion
items' have been implemented. All private keys are now managed with a
new 'master_keys' bank that contains all priv/pub keys needed for
master operation. the cache interface is re-used in gen_keys for the
minion, which is slightly confusing but not the end of the world.

this is sufficiently tested in tests/pytests/unit/crypt/test_crypt.py

most of the operations on minion id are actually operations on the key
store, which is what salt.key provides. this refactors those parts of
the minion data cache api to use a salt.key object instead.

this commit also includes a critical performance optimization to avoid
calling _pki_minions only when necessary. in particular, recursive calls
in compound matching could call pki_minions multiple times; this change
passes in minions= to allow for subset matching to apply, avoiding a
full round trip. On smaller local installs this isn't a big deal, but on
a 75k minion cluster it adds up excessively.

this can be monstrous overhead based on the amount of ACL and rules
needing to be checked, combined with how many keys you have on our
master. rather than eeagerly fetch _pki_minions, we wrap it in a closure
so that it only gets fetched if the input compound expression actually
requires it. we further only pass it to the sub matchers if provided,
as these backends can further optimize their fetches if the query is on
the full pki set.

also update this PR's md with a few lines to describe the changes
within.