WIP - Make ssl_client_ca_auth work as intended

I couldn't configure the `ssl_client_ca_auth` to behave in a way that
it's documented it should behave.  This is a problem since we explicitly
included this in Puppet 3 to make external CA's easier to support.

We need to take the collection of CA's the user explicitly lists for the
purposes of authorization and make sure the peer certificate is issued
by one of these CA's.