(PE-6014) Don't initialize SSL when not CA

Despite the number of commits and test changes, this didn't end up being as drastic of a production code change as we were expecting. Since we decided to hold off on the fail-fast behavior, some of the changes made in early commits to prepare for that are not necessary and are undone in later commits. Therefore it might be easier to look at the overall changes rather than per-commit.

----

The heart of this PR is the addition of `initialize-master-ssl!` to the CA service protocol. The master service has been refactored to call this protocol method instead of the function in the CA namespace. The function `initialize-master-ssl!` has not changed behavior, although the arguments were collapsed so it accepts the entire `ca-settings` map instead of 10 different values from that map.

By initializing the master SSL files via the protocol method, we can now turn on/off this initialization by choosing the appropriate CA service in the bootstrap config.

I've created https://tickets.puppetlabs.com/browse/SERVER-30 to capture the fail-fast behavior that we decided not to do here.
We decided to hold off on changing the behavior around the generation/fail of the master's SSL files.  See SERVER-30 for that work.