Purge removed public certificates

[olifre]

Currently, the code in certificates.pp does:

file { "${::settings::ssldir}/certs":
      ensure  => directory,
      recurse => true,
      ignore  => 'pe-internal-*',
      source  => "puppet://${::settings::ca_server}/public_certificates/", # lint:ignore:puppet_url_without_modules
}

This leaves old public certificates which may have been revoked in place on the puppet masters, and allows the corresponding machine to access secure data via node_encrypt.

I would propose to add:

purge => true,

to clean up removed cruft.