(#5552) Clean up subcommand handling inside puppet cert.

We now have a regular, testable mechanism for handling the legacy '--' version
of subcommands, as well as a modern bareword subcommand pattern. This makes
it sensible to test command handling and avoid regressions.

We identified a few quirks in the command line as part of this process.

Pair-With: Jesse Wolfe <jesse@puppetlabs.com>
Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>