rpearce: Make puppetmaster provisioning use poll_sign as we cannot use
sign (csr).

Reasoning documented here (http://docs.puppetlabs.com/references/3.6.latest/configuration.html#csrattributes): You should ensure that this file (csr_attributes.yaml) does not exist on your CA puppet master; if it does, unwanted certificate extensions may leak into certificates created with the puppet cert generate command.