Add x509_cert and x509_csr types and providers

[raphink]

This PR provides three new types and associated openssl providers:

• ssl_pkey generates a private key;
• x509_cert generates a certificate from a private key and a given template;
• x509_request generates a certificate signing request based on a given a key (private_key) and a template.

Examples:

ssl_pkey { '/etc/ssl/my.key':
  ensure     => 'present',
  password   => 'crackmenot', # optional
}

x509_cert { '/etc/ssl/my.crt':
  ensure        => 'present',
  private_key   => '/etc/ssl/my.key', # optional, uses .key if not specified
  password      => 'crackmenot', # to decrypt the key
  days          => 3650,
  template      => '/path/to/my_template.cnf',
  force         => true, # Re-generate certificate if key has changed
}

x509_request { '/etc/ssl/my.csr':
  ensure        => 'present',
  private_key   => '/etc/ssl/my.key', # optional, uses .key if not specified
  password      => 'crackmenot', # to decrypt the key
  template      => '/path/to/my_template.cnf',
  force         => true, # Re-generate certificate if key has changed
}

These three providers make it possible to replace files/generate-x509-cert.sh and openssl::genx509, and to rewrite openssl::certificate::x509 as a wrapper doing:

• generate and deploy the certificate template (file resource, unchanged);
• generate the private key using the ssl_pkey type;
• generate the certificate using the x509_cert type;
• generate the certificate signing request using the x509_request type.