(#17295) use SHA1 to sign CSRs when SHA256 is not available.

Without this patch applied puppet fails to create a CSR
with the following message -

    Error: Could not request certificate: uninitialized constant OpenSSL::Digest::SHA256

This patch adds a class Puppet::SSL::CertificateSigner that
takes care of signing certificates in CSR creation and via
the CA.  This class assumes a default hash algorithm of
SHA256 and if not available falls back to SHA1.  For the
sake of FIPS 140-2 compliance it does not try MD5 or any
earlier hash algorithms.
Merge branch 'alexharv074-ticket/3.0.x/17295_puppet_not_sanity_checking_default_digest'

* alexharv074-ticket/3.0.x/17295_puppet_not_sanity_checking_default_digest:
  (#17295) use SHA1 to sign CSRs when SHA256 is not available.

closes #1413