(maint) Add note about Puppet's handling of CN in the DN

Dustin mentioned that it's worth calling out how Puppet handles the CN
field with respect to the DN, aka subject.

This patch adds the missing information and explicitly mentions that
Puppet will parse out the CN field and use the value for authentication
and authorization.

[ci skip]