(PE-6014) Create NOOP CA service

I see.  Maybe we should just add a `with-puppet-conf-dir` that is wrapped by `with-puppet-conf`?  not a blocker, your call.