Fixes #4464 - policy for foreman-proxy

This is preliminary policy for proxy, feel free to review and *test*.
Instructions how to easily test will follow.

What was tested so far:

* create host
* edit host
* rebuild host
* delete host
* list puppetca certificates

PLEASE I NEED YOUR ASSISTANCE WITH HELPING TO TEST THIS POLICY. It is piece of
cake to test it, won't break your existing instance at all. Read the
instructions in my comments bellow.
Probably best to have a new tunable to represent the "puppet" module of the smart proxy ("foreman_proxy_manage_puppet"), and replace this use_puppet_api tunable as it's the modern/future default behaviour.

If you want to keep the use_puppet_api tunable for older (pre Puppet 3.6) versions then I guess you could, but it seems an unnecessary extra.