add support for an external autosign command

This change adds 2 parameters:

1. `csr_attributes_file`
Allows for specifying user defined attributes to be added to the CSR. The file is yaml instead of flat key/value as this allows you to have an array of values for a parameter (which is also allowed in a CSR).

2. `autosign_command`
Allows for running an external command to determine whether a certificate should be automatically signed or not. The command is passed the certificate name as the first argument. The command should then exit with status `0` to indicate that the certificate should be signed, and status non-0 to indicate it should not be signed.
Merge branch 'cert-autosign2' of github.com:phemmer/puppet-1 into cert-autosign2

# By Henrik Lindberg (138) and others
# Via Adrien Thebo (93) and others
* 'cert-autosign2' of github.com:phemmer/puppet-1: (603 commits)
  add support for an external autosign command
  (packaging) Update PUPPETVERSION for 3.3.0
  (packaging) Update PUPPETVERSION for 3.3.0-rc3
  (maint) ignore Gemfile.local
  (#22383) Allow all boolean values for atboot
  (#22258) Create new console for each puppet run
  Docs: Clarify descriptions of "ordering" and "report_serialization_format" settings
  (#21427) make supported_formats return an array of symbols
  (#21427) Handle loss of precision during YAML serialization
  (#21427) Make report format selectable
  (#22375) Don't echo the backed up file to the caller
  (#22375) Prefer raw-like serialization format
  (#22358) Interpret */* as anything is accepted
  (#19056) strip trailing space while parsing AIX password file
  (packaging) Update PUPPETVERSION for 3.3.0-rc2
  (#22319) Constrain settings watchedfile integration on windows
  (#22319) Correct Puppet::Setting's use of WatchedFile
  (#22229) Provide way of getting the container
  (#22229) Ensure generated resources contained
  (Maint) Mark AdditionalResourceGenerator as private
  (#22250) refactor previous and add spec tests
  (maint) Limit ignore to root doc/ directory
  (packaging) Update PUPPETVERSION for 3.3.0-rc1
  (#22250) ensure a failed resource status always has an event
  (Bug #22237) Remove EOL Fedora 17
  (Maint) Add docs for #relationship_graph
  (#22205) Reinstate relationship_graph as a factory method
  (#22205) Select manifest ordering for ordering test
  (#22191) Rename cancelled to canceled
  (#22191) Always process internal catalogs
  (#22191) Mark ready, but unevaluated resources, as skipped
  (#22191) Add cancelled resource handler
  (#22205) Extract common Prioritizer code into a superclass
  (#22205) Chose a Prioritizer based on Puppet[:ordering]
  (#22205) Re-introduce old ordering as a Prioritizer
  (#22205) Provide setting to control manifest ordering
  (#22205) Add enum setting type
  (Maint) Restructure requires for settings
  (Maint) Removed commented out settings
  (#22205) Extract class for generating resource priorities
  ...