(#6112) Only attempt to sign a certificate once.

Prior to this patch, autosigned certificates would see a second call to
CertificateAuthority#sign which would result in an extraneous error
message being logged.

This patch short circuits and returns the signed certificate if
available prior to attempting to sign.

It also clears a duplicate host assignment in
CertificateAuthority.generate, and logs autosigning attempts.

A new acceptance test has been added to document the current puppet cert
generate behavior (with the above change) on a host that is the CA, on
one that is not, with and without autosigning, with and without
submitting --dns_alt_names.