(PUP-2310) Treat a CRL as expired if it's past next_update

Without CertificateRevocationList#expiration defined,
Puppet::Indirector::Indirection#find_in_cache considers a cached CRL to
always be valid. This is a problem because the Puppet agent fails to
establish an SSL connection to the master when it tries to make use of
the expired CRL.

By treating a CRL as expired if it's past its next_update timestamp,
the Puppet agent will invalidate and refresh its CRL from the master
before proceeding with its run.