cephadm: create rgw keys with the rgw profile

replace mon 'allow *', mgr 'allow rw', osd 'allow rwx tag rgw *=*' with
the rgw profile, once require_osd_release says every mon and osd can
read it. until then keys keep the old caps. existing keys pick the
profile up through auth caps the next time the daemon is redeployed.

nfs embeds librgw, so its rgw key takes the same osd profile behind the
same gate. its mon cap stays 'allow r'.

Signed-off-by: Matthew N. Heler <matthew.heler@hotmail.com>