(#2848) Only mark subjectAltName critical if subject is empty.

From X509v3, the subjectAltName extension should only be marked critical if
the subject DN is empty:

"If the subject field contains an empty sequence, then the issuing CA MUST
include a subjectAltName extension that is marked as critical. When including
the subjectAltName extension in a certificate that has a non-empty subject
distinguished name, conforming CAs SHOULD mark the subjectAltName extension
as non-critical."

This applies that rule, by always marking the subjectAltName as
non-critical, because we never have an empty name in our system.

Signed-off-by: Daniel Pittman <daniel@puppetlabs.com>