(PUP-3114) Added an enforcement for FIPS

FIPS mode requires that the keylength be restricted to 2048 bits instead
of the new standard 4096.

This patch provides that proper enforcement.
Is there a way to query OpenSSL programmatically to determine if it is in FIPS enabled mode? That way we're not dependent on a particular facter version?