Use hiera as a lightweight ENC

Doesn't currently include any modules, because we don't have any.
Cribbed from HMRC and @nickstenning.
hiera lookup use clientcert instead of hostname

This variable is less likely (impossible?) to be spoofed. It is also fully
qualified. Whereas a Puppet agent can send whatever `hostname` or `fqdn`
Facter value they like.
Tag version 0.0.2