[#77197788] Add check_puppetdb_ssh_host_keys

A new check that will query PuppetDB for SSH host key facts and raise an
alert if any duplicates are found. This will be used to prevent provisioning
errors where a new host key hasn't been re-generated.

The output lists all of the affected hosts grouped by SSH key. I've
converted the public key to a fingerprint to make the output easier to read.
I'm not listing the key types but they should be easy to find with
`ssh-keygen -lf` on the affected host. I'm also not comparing individual key
types like-for-like, but I think that should be fine, because they should
all be unique anyway.

UNKNOWN will be raised if there are less than two hosts found which should
prevent any problems with the PuppetDB query terms giving false-negatives.
It will also raise UNKNOWN for any errors, such as failing to connect to
PuppetDB or parsing the JSON output, because the entry point is wrapped in a
try block. Although I'm not sure how to test that. It works on the command
line but not in nose.

PuppetDB hostname, protocol and API version are all configurable. But they
default to the values that we currently need. Techincally this API endpoint
should be the same for version 1 through to 4.

---

Rebased from #7 to use facts instead of `@@sshkey` resources because it's:
- less specific to our use case
- facts get exported even if the catalog compilation fails
I don't think it matters, but there's a missing final CR/LF here.