restrict rspec-core gem to < 3

To work around rspec 3 being incompatabile with rspec-puppet 1.0.1 (currently,
the latest release)

    RSpec::Puppet::FunctionMatchers::Run implements a legacy RSpec matcher
    protocol. For the current protocol you should expose the failure messages
    via the `failure_message` and `failure_message_when_negated` methods.
    (Used from /home/jhoblitt/github/puppet-nsstools/spec/functions/nsstools_add_cert_spec.rb:21:in `block (2 levels) in <top (required)>')
add option to enable FIPS on the NSS DB.
Add type for creating a cert and key directly in the NSS DB.