Add missing dependency

The crl needs to be fetched before trying to deal with any
puppet_certificate resources.