doc: describe the rgw cap profile

document profile rgw and move the rgw keyring examples onto the profile.

a gateway using it can only read config-key under the rgw/ prefix, so
say that where ssl_certificate and ssl_private_key describe config://.

Signed-off-by: Matthew N. Heler <matthew.heler@hotmail.com>