Make encryptquerystring provision optional

Since KNOX-1136, Knox saves the encryptQueryString alias in the given topology's credential store when processing the descriptor.

The problem with this approach is, that, in some cases, it may happen that 3rd party deployment tools (such as Cloudera Manager) persists that secret in a separate phase and

• this makes the Knox call redundant
• Knox will override the previously saved value silently

Proposal:

• introduce a new descriptor-level property called provision-encrypt-query-string-credential (defaults to true) which controls this behavior
• if the descriptor is configured with provisionEncryptQueryStringCredential = false, no credential store operation should be done to save that alias.