(PUP-3520) Refactor Puppet OID registration to be explicit

Prior to this commit, the Puppet::SSL::Oids module would register with
OpenSSL the list of special Puppet OIDs every time it was
loaded (i.e. implicitly during require 'puppet/ssl/oids'). This commit
refactors the registration calls into a module method that is invoked
from the following application faces: agent, master, cert, certificate,
and ca.

The reason for this refactoring is to try and avoid all implicit calls
into OpenSSL so that it is easier to eliminate/avoid the OpenSSL usage
when the Puppet ruby code is loaded into Puppet Server.

The relevant acceptance test that should cover these changes is
puppet/acceptance/tests/ssl/certificate_extensions.rb
It was being called every time the module was `require`d also, but yes, it is okay to register these multiple times.

Also, the different apps don't use one another - they're each a separate entry point into the code. There should only be a single call to register the OIDs during any of `puppet master/agent/cert/certificate/ca ...`