(PUP-3676) Move OpenSSL::X509::Name calls in util/ssl.rb

This commit moves the initialization of a couple of constants in
`Puppet::Util::SSL` down into the body of the `subject_from_dn` method.

The purpose of the change is to avoid having this initialization, which
involves creating `OpenSSL::X509::Name` objects, be done when Puppet is
running under Puppet Server.  We've been trying to avoid calls into
JRuby OpenSSL as doing so has caused many problems for Puppet Server.

The `subject_for_dn` method is the only code which referenced these
constants and `subject_for_dn` is only called by the Rack HTTP handler,
which is not used by Puppet Server.

To test these changes, I ran all of the puppet spec tests and observed that
they passed.  I also setup Puppet under Apache/Passenger and instrumented
the Puppet code to see that the `subject_for_dn` method still returned the right
DN for the client certificate provided by the agent making a request to the master.
I wonder if we should make this a class member and do an ||= here so there's only ever one, rather than one per invocation.