Auth crl allow

This patch first refactors puppet::config a bit to make it easier to extend. It also adds fairly minimal tests. The next patch adds an auth_crl_allow parameter. http://docs.puppetlabs.com/guides/scaling_multiple_masters.html#option-2-proxy-certificate-traffic states the following should be present in auth.conf if using a puppet ca proxy:

path /certificate_revocation_list
auth any
method find
allow *

In my testing /certificate_revocation_list/ca was sufficient.