(PUP-3520) Refactor Puppet OID registration to be explicit

Prior to this commit, the Puppet::SSL::Oids module would register with
OpenSSL the list of special Puppet OIDs every time it was
loaded (i.e. implicitly during require 'puppet/ssl/oids'). This commit
refactors the registration calls into a module method that is invoked
from the following application faces: agent, master, cert, certificate,
and ca.

The reason for this refactoring is to try and avoid all implicit calls
into OpenSSL so that it is easier to eliminate/avoid the OpenSSL usage
when the Puppet ruby code is loaded into Puppet Server.

The relevant acceptance test that should cover these changes is
puppet/acceptance/tests/ssl/certificate_extensions.rb
The only app that would be invoked during a `puppet ...` command is whatever follows `puppet`, so in the case of `puppet master --daemonize ...` that would just be the master app (`lib/puppet/application/master.rb`).  The `ca` app is invoked by `puppet ca ...`.