Conditionally manage puppetdb connection

This allows us to bring up the puppet3 master in an automated way,
then flip on puppetdb later. Most importantly this allows for a step
in the middle where an infra core applies the puppetmaster3 cert
and key from the original puppetmaster.

Change-Id: I77a815591649d55b8c17fb9431add0edd68ce0d2
Merge "Conditionally manage puppetdb connection"