Allow certs to be signed by fingerprint

Puppet cert sign should support signing by fingerprint. Signing by hostname can be dangerous and/or annoying if an attacker creates certificate requests in bulk with hostnames that you want to sign. Fingerprint should not be remotely guessable, and should be the safest option.

This will probably involve updates to both the CA API and the puppetserver ca command line tool.