(PUP-1407) Rewrite certificate_revocation_list test to use a temporary CA instead of mocks
(PUP-1407) Verify that CRL times are within expected ranges

Modifies the test so that we verify the CRL last and next update times are
in UTC time (per the RFC) and that the number of seconds since the epoch
are within 5 minutes (plus or minus) of the expected value.

Also modifies the test to use public APIs to access the CA cert and
private key.
(PUP-1407) Add authorityKeyIdentifier to CRL to make the CA conform to RFC5280

RFC5280 requires CRLs to contain the authorityKeyIdentifier extension[1].
It identifies the public key that corresponds to the private key used to
sign the CRL.

RFC5280 also requires the use of the key identifier method. This
implementation uses the key identifier format described in OpenSSL[2].
In particular, the `always` value is used to require that the extension
is present.

Also note that we need to invoke the `add_extension` method instead of
overwriting the extensions.

[1] http://tools.ietf.org/html/rfc5280#section-5.2.1
[2] http://www.openssl.org/docs/apps/x509v3_config.html#Authority_Key_Identifier_
(PUP-1407) Verify extensions are still present after revocation

Previously, we were only testing that the crlNumber and authorityKeyIdentifier
extensions were present when a CRL is generated, but not when it is revoked.

This adds helpers for testing the extensions and updates both cases to use them.
It also is more explicit in verifying that the authorityKeyIdentifier extension
has the same value as the subjectKeyIdentifier from the issuing CA cert.
(PUP-1407) Actually test deserialization and CRLReasons

Previously, the test was stubbing everything about how CRL
deserialization worked to the point that `from_s('my crl')` was passing
when it shouldn't. The from_s method expects a PEM encoded string.

This commit actually tests deserialization, and adds tests to ensure the
CRL contains CRLReason entry with valid reason codes.
Merge branch 'pr/2238'

* pr/2238:
  (PUP-1407) Actually test deserialization and CRLReasons
  (PUP-1407) Verify extensions are still present after revocation
  (PUP-1407) Add authorityKeyIdentifier to CRL to make the CA conform to RFC5280
  (PUP-1407) Verify that CRL times are within expected ranges
  (PUP-1407) Rewrite certificate_revocation_list test to use a temporary CA instead of mocks

Closes GH-2238
(PUP-1407) Fix specs on 187

In ruby 1.8.7, OpenSSL::X509::Name does not include Comparable, so `==` is
not based on the `<=>` operator. As a result, comparing two Name objects
that have the same string representation will return false. In ruby 1.9,
the class includes the Comparable module. Changed the test to just compare
the String representations.

The other test was failing for me on ruby 187, and it seemed completely
unnecessary to compute 2**158 every time the test runs.
Merge branch 'master' of https://github.com/puppetlabs/puppet