Candlepin certs rework

Also removed some unnecessary explicit dependencies (that are inherited form the parent class) such as notifying tomcat6 service when cpdb_done, as that should be handled with `class { 'candlepin::config' :} ~> class {'canldelpin::service': }`.