Expose ca_location parameter

This is necessary if the puppet_certificate type can't figure it out
sanely and it needs to be explicit.