(#15561) Add External CA acceptance test

This patch adds three acceptance tests:

  1: Externally issued certificate chains work.
  2: Email addresses in certificate names work.
  3: Certificate revocation works.

              +-----------------+
              |     Root CA     |
              |  (Self Signed)  |
              +--+------------+-+
                 |            |
           +-----+            +------+
           |                         |
           v                         v
    +-------------+            +------------+
    | Issuing CA  |            | Issuing CA |
    | For Masters |            | For Agents |
    +-------+-----+            +------+-----+
            |                         |
            |                         |
            v                         v
    +-------------+            +-------------+
    | Master SSL  |            | Agent SSL   |
    | Certificate |            | Certificate |
    +-------------+            +-------------+

A master may restrict clients to those with a certificate issued by a
specific DN.  For example, the Apache `SSLRequire %{SSL_CLIENT_I_DN_CN}
== "Agent CA"` directive will only allow agent with certificates issued
by "Agent CA"

These examples exercise Puppet agents checking for revoked master
certificates by populating a CRL file out of band.

Finally, subject names with email addresses in the name are checked in
an effort to prevent regressions on #15561.  For example,
`CN=agent-email3.example.org/emailAddress=test@example.com`.

This fixture data is intended for, and supported on, EL-6 master hosts
with Apache 2.2 or later and Passenger 3.0.17 from EPEL.

This test is confined to the `el-6` platform.