Simplify agent SSL initialization

The Puppet X.509 PKI initialization logic is currently confusing, inconsistent, and buggy, due to the ad hoc nature of its implementation. The Puppet::SSL::Host class is responsible, either directly or indirectly, for fetching the CA certificate, CRL, RSA key pair, CSR, and certificate. This initialization is scattered across a number of functions and files, and is largely triggered by lazy methods. This structure makes it very hard to reason about or improve the PKI initialization process.