(PUP-3520) Refactor Puppet OID registration to be explicit

Prior to this commit, the Puppet::SSL::Oids module would register with
OpenSSL the list of special Puppet OIDs every time it was
loaded (i.e. implicitly during require 'puppet/ssl/oids'). This commit
refactors the registration calls into a module method that is invoked
from the following application faces: agent, master, cert, certificate,
and ca.

The reason for this refactoring is to try and avoid all implicit calls
into OpenSSL so that it is easier to eliminate/avoid the OpenSSL usage
when the Puppet ruby code is loaded into Puppet Server.

The relevant acceptance test that should cover these changes is
puppet/acceptance/tests/ssl/certificate_extensions.rb
Wouldn't some apps be invoked more than once during a Puppet daemon launch - like master and ca?  This may all be a moot point anyway, though, if this is idempotent from an OpenSSL library perspective.  Just wasn't sure...