Add ConsumerEntitlementResource to debloat ConsumerResource

Working on pulling things out of ConsumerResource that act
like a full-blown resource themselves.  I really wish
certificates branched off of entitlements, but it doesn't
look like that can work out.