Backport new CA CLI gem to 5.3.x

We have added a new command line tool for interacting with the Puppet CA, under the {{puppetserver ca}} command. This can be used to generate an intermediate CA for puppetserver (note that caveats about needing to manually copy these certs to agents still apply in the Puppet 5 series), generate, sign, revoke, clean, and list certs. All of these actions are executed by making requests to Puppet Server's CA API, in particular the {{certificate_status}} and {{certificate_statuses}} endpoint. Note that currently requests to these endpoint are denied by the blanket rule in {{auth.conf}}, so if you would like to try out the new tool, you should first add two rules to {{auth.conf}}, whitelisting your master's certname to talk to those two endpoints. The {{puppet cert}} command and other assorted CA-related puppet subcommands are going to be removed in Puppet 6, so we encourage you to try out this tool now and give us feedback on any bugs or functionality gaps, so we can fix them before removing the tools is it replacing.