Add x509_cert and x509_csr types and providers

This PR provides three new types and associated openssl providers:
* `ssl_pkey` generates a private key;
* `x509_cert` generates a certificate from a private key and a given template;
* `x509_request` generates a certificate signing request based on a given a key (`private_key`) and a template.

Examples:

    ssl_pkey { '/etc/ssl/my.key':
      ensure     => 'present',
      password   => 'crackmenot', # optional
    }

    x509_cert { '/etc/ssl/my.crt':
      ensure        => 'present',
      private_key   => '/etc/ssl/my.key', # optional, uses .key if not specified
      password      => 'crackmenot', # to decrypt the key
      days          => 3650,
      template      => '/path/to/my_template.cnf',
      force         => true, # Re-generate certificate if key has changed
    }

    x509_request { '/etc/ssl/my.csr':
      ensure        => 'present',
      private_key   => '/etc/ssl/my.key', # optional, uses .key if not specified
      password      => 'crackmenot', # to decrypt the key
      template      => '/path/to/my_template.cnf',
      force         => true, # Re-generate certificate if key has changed
    }

These three providers make it possible to replace `files/generate-x509-cert.sh` and `openssl::genx509`, and to rewrite `openssl::certificate::x509` as a wrapper doing:
* generate and deploy the certificate template (file resource, unchanged);
* generate the private key using the `ssl_pkey` type;
* generate the certificate using the `x509_cert` type;
* generate the certificate signing request using the `x509_request` type.