Add waitforcert and export tag

waitforcert so that we can sign new certificates as the Puppet run
progresses on non-ca systems, and export tag so that when collecting
activemq connectors we can easily exclude the exported resource
generated by the self node.