(#17295) use SHA1 to sign CSRs when SHA256 is not available.

Without this patch applied puppet fails to create a CSR
with the following message -

    Error: Could not request certificate: uninitialized constant OpenSSL::Digest::SHA256

This patch adds a class Puppet::SSL::CertificateSigner that
takes care of signing certificates in CSR creation and via
the CA.  This class assumes a default hash algorithm of
SHA256 and if not available falls back to SHA1.  For the
sake of FIPS 140-2 compliance it does not try MD5 or any
earlier hash algorithms.