Add ca_location parameter to pe_puppet

The auto-detection of whether a CA is remote or local built into the
puppet_certificate type is iffy at best. This commit adds a parameter to
the pe_puppet class that lets us explicitly specify local or remote to
work around that imperfect detection.