Add --allow-dns-alt-names option to puppet certificate sign

This behaves similarly to the corresponding option to puppet cert. It
will allow a certificate request containing DNS alt names to be signed,
and will not fail if DNS alt names are not present. This option is only
allowed when the ca-location is not remote.