(#15561) Extract CN from certificate subjects more carefully

When using certificate chaning or otherwise generating SSL certificates
outside of Puppet, the subject often has multiple components, e.g.,
  /CN=hostname.foo.com/O=Foo, Inc./OU=Marketing/emailAddress=it@foo.com
The hostname, which is later verified against a strict set of allowed
characters, is only extracted from the "CN" field, with all othe fields
ignored.