(#2848) Consistent return values from subject_alt_names accessors.

The various implementations of the subject_alt_names accessor on SSL objects
had different return types when the records were not present: nil, or an empty
array.

This unifies them to consistently return an empty array, which makes it easier
to iterate across the code. It also cleans up some logic around handling
policy on those, to make it cleaner and quicker by not duplicating the same
"are there any subjectAltName values?" test across every policy check.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>