Ellipsoid.geodeticSurfaceNormal returns wrong result if the cartesian is not on the ellpsoid surface

I encountered this while working on #4622.

[Sandcastle for this issue](http://cesiumjs.org/Cesium/Apps/Sandcastle/index.html?src=Hello%20World.html&label=Showcases&gist=05a014303d59afd7bec1e4d0cbce5930)

The following code log `false` to console:

```
var latitude = 45.0;
var longitude = 90;

var cartographic = Cesium.Cartographic.fromDegrees(longitude,latitude);
var cartesian = Cesium.Ellipsoid.WGS84.cartographicToCartesian(cartographic,new Cesium.Cartesian3());
var surfaceNormal = Cesium.Ellipsoid.WGS84.geodeticSurfaceNormal(cartesian,new Cesium.Cartesian3());

cartographic.height= 2000000;
var cartesian2 = Cesium.Ellipsoid.WGS84.cartographicToCartesian(cartographic,new Cesium.Cartesian3());
var surfaceNormal2 = Cesium.Ellipsoid.WGS84.geodeticSurfaceNormal(cartesian2,new Cesium.Cartesian3());

//log 'false'
console.log(Cesium.Cartesian3.equalsEpsilon(surfaceNormal,surfaceNormal2, Cesium.Math.EPSILON8));
```

However, `Ellipsoid.geodeticSurfaceNormalCartographic` returns accurate result in this case:

```
var cartographic = Cesium.Cartographic.fromDegrees(longitude,latitude);
var surfaceNormalFromCartographic = Cesium.Ellipsoid.WGS84.geodeticSurfaceNormalCartographic(cartographic);

cartographic.height= 2000000;
var surfaceNormalFromCartographic2 = Cesium.Ellipsoid.WGS84.geodeticSurfaceNormalCartographic(cartographic);

//log 'true'
console.log(Cesium.Cartesian3.equalsEpsilon(surfaceNormalFromCartographic,surfaceNormalFromCartographic2, Cesium.Math.EPSILON8));
```

Start with Cesium.Ellipsoid.geodeticSurfaceNormal and compare it with geodeticSurfaceNormalCartographic using the reproduced WGS84 example in the issue. Verify the result for Cartesian positions at both zero and 2,000,000 height, then add or update coverage so the surface normals agree within the demonstrated epsilon.

Written by the indexing model from the issue text.