refs #4345: Add a server_ca_proxy

http://docs.puppetlabs.com/guides/scaling_multiple_masters.html#option-2-proxy-certificate-traffic
describes how to set up a proxy CA. This adds a parameter to set up the
ca proxy on the puppet master.
Refactor puppet::config and add tests
Issue #4345: Add an allow_any_crl parameter

http://docs.puppetlabs.com/guides/scaling_multiple_masters.html#option-2-proxy-certificate-traffic
states the following should be present in auth.conf if using a puppet ca
proxy:

path /certificate_revocation_list
auth any
method find
allow *

In my testing /certificate_revocation_list/ca was sufficient.