(PUP-3520) Refactor Puppet OID registration to be explicit

Prior to this commit, the Puppet::SSL::Oids module would register with
OpenSSL the list of special Puppet OIDs every time it was
loaded (i.e. implicitly during require 'puppet/ssl/oids'). This commit
refactors the registration calls into a module method that is invoked
from the following application faces: agent, master, cert, certificate,
and ca.

The reason for this refactoring is to try and avoid all implicit calls
into OpenSSL so that it is easier to eliminate/avoid the OpenSSL usage
when the Puppet ruby code is loaded into Puppet Server.

Since Puppet OID registration is no longer automatic, tests that rely on
CSR extensions using the Puppet OIDs must explicitly register them for
use. This is necessary since the tests do not go through any of the
application faces where the OID registration has already been taken care of.