Add a 'waitforcert' parameter to the puppet_certificate type

Previously, the certificate type would fail immediately if a
certificate request was not already signed, necessitating a second run
of puppet once the signing had occured. With this change, it is now
possible to have the puppet run block and wait for the certificate to
be signed out-of-band before continuing.

This isn't super-clean, but it works.