(#15561) Add External CA acceptance test

This patch adds three acceptance tests:

  1: Externally issued certificate chains work.
  2: Email addresses in certificate names work.
  3: Certificate revocation works.

              +-----------------+
              |     Root CA     |
              |  (Self Signed)  |
              +--+------------+-+
                 |            |
           +-----+            +------+
           |                         |
           v                         v
    +-------------+            +------------+
    | Issuing CA  |            | Issuing CA |
    | For Masters |            | For Agents |
    +-------+-----+            +------+-----+
            |                         |
            |                         |
            v                         v
    +-------------+            +-------------+
    | Master SSL  |            | Agent SSL   |
    | Certificate |            | Certificate |
    +-------------+            +-------------+

A master may restrict clients to those with a certificate issued by a
specific DN.  For example, the Apache `SSLRequire %{SSL_CLIENT_I_DN_CN}
== "Agent CA"` directive will only allow agent with certificates issued
by "Agent CA"

These examples exercise Puppet agents checking for revoked master
certificates by populating a CRL file out of band.

Finally, subject names with email addresses in the name are checked in
an effort to prevent regressions on #15561.  For example,
`CN=agent-email3.example.org/emailAddress=test@example.com`.

This fixture data is intended for, and supported on, EL-6 master hosts
with Apache 2.2 or later and Passenger 3.0.17 from EPEL.

This test is confined to the `el-6` platform.

Expected output on the agent when the master certificate has been
revoked is:

    Error: Could not retrieve catalog from remote server:
    SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed:
    [certificate revoked for /CN=master1.example.org]
    Error: Could not retrieve catalog; skipping run
Remove ServerName from Apache Virtualhost

I'm including this small patch because this mis-configuration caused
quite a bit of hurt for me.

Without this patch applied, both virtual hosts running on 8140 and 8141
use the same SSL certificate, the one configured in 8140.  This is a
problem because the second, 8141, virtual host is configured to use a
different certificate that is intended to be rejected by the agent.

Because the first cert is being used the agent does not know to reject
the connection.  This, in turn, caused a false-positive success in the
acceptance test that validates an agent refuses to connect to a rogue
master.

This patch fixes the problem by removing the ServerName statements
included in the virtualhost blocks.  With these statements removed from
the configuration the server on 8140 presents a cert issued by the
Master CA and the server on 8141 presents a cert issued by the Agent CA,
as expected.
(maint) Clean up the httpd.conf used in testing
(#20027) Add acceptance test for ssl_client_ca_auth
WIP - Proper test for ssl_client_ca_auth