(Maint) Make a CRL valid on the same second it is updated

Backport commit 15a9fb76096e1d0d3642ae2ebcfa72ea9abc367f which
eliminates time-sensitive spec failures due to the CRL not being yet
valid.

Because openSSL says that a CRL is valid only at least one second after
it was last updated, setting the last_updated field to right now causes
the CRL to be not valid for one second. This was showing up as an
intermittent failure in our test cases.

The CRL is now always made to be last_updated one second ago so that it
is immediately valid.
Merge branch '2.7.x' into 3.1.x

* 2.7.x:
  (Maint) Make a CRL valid on the same second it is updated

Conflicts:
	lib/puppet/ssl/certificate_revocation_list.rb