(#7962) Added settings class for handling time intervals.

The DurationSetting converts strings with units into a number of
seconds, but more importantly guarantees that the setting will be an
integer. The following settings can now be specified as durations:

  configtimeout
  filetimeout
  waitforcert
  splaylimit
  runinterval
  rrdinterval
  ca_ttl

Since multiple settings can use this format, the description was removed
from `ca_ttl` to be added to the config section of puppet-docs.

Also note, since many of these settings specify sub-hour times, the unit
'm' was added for specifying times in minutes.
(#7962) Added rate-limiting logger utility

`Puppet::Util::Log::RateLimitedLogger` is a class that includes the
standard logging module and so responds to `info`, `warning`, etc. It
uses log messages themselves as keys to a hash that records the last time
they were logged and at which level. When a message is logged, it first
checks the record and ignores the call if the given time interval has
not yet elapsed since the last time it was logged.
(#7962) Added `from_instance()` method to base SSL class

Instead of creating certificates by turning OpenSSL::X509::Certificate
instances into strings then back into a new instance, just reuse them.
This method is on the base SSL class, so it can be used for keys,
certificate requests, etc.

The side effect of this change is that extracting the certificate 'name'
out of its subject is abstracted (`name_from_subject()`), and it no
longer calls downcase on the name. This is safe since it's downcased in
the base class constructor, and also provides a prettier 'name' if
needed.
(#7962) Added certificate expiration 'nearness' logic

`Puppet::SSL::Certificate` now has a `near_expiration?` method that
takes a time interval and returns whether its expiration is within that
window from now. The time interval defaults to a new config setting
called `certificate_expire_warning` which defaults to 60 days.
(#7962) Added certificate expiration checks.

Warnings are logged both when receiving a request and issuing a request
so that both the master and agent logs contain warnings. This increases
visibilty since the master logs are looked at more frequently, but also
ensures that the warnings make it into agent reports.

The new `Puppet::Network::Authentication` module contains the logic for
logging the expiration warnings (certificates are part of the
authentication process, hence the name). It uses a rate-limited logger
so that identical warnings as a result of multiple requests in the same
run are not logged. The minimum time between log messages is set to the
`runinterval` setting, since it is a good tradeoff between ensuring
visibility and noisiness.
Remove old apple package rake task

The apple package task in tasks/rake is superceded
by the packaging repo task of the same name and
functionality. This commit removes it; it should
have been removed with the original set of packaging
changes to use the packaging repo.

Signed-off-by: Moses Mendoza <moses@puppetlabs.com>
Merge pull request #1118 from vrthra/ticket/3.x/13452_solaris_acceptance_tests

(#13452) solaris acceptance tests
Merge pull request #1079 from vrthra/ticket/3.x/16160_fix_zfs

(#16160) handle aclmode and shareiscsi removal.
Merge pull request #1120 from MosesMendoza/maint/3.x/remove_apple_pkg_task

Remove old apple package rake task
Merge pull request #1074 from slindberg/ticket/3.x/7962_cert_expire_warning_redux

(#7962) Certificate expiration warnings
(maint) Confine pty-based test to non-Windows hosts.

Pty detection on Windows is broken in Ruby 1.8.7. This causes tests which use
a pty to freeze, locking up the test suite.

This patch works around the issue by not running the affected test on Windows
hosts.
Merge remote-tracking branch 'origin/2.7.x' into 3.x
Merge pull request #1072 from vrthra/ticket/3.x/15547_fix_mock

(#16239) mock of facter :operatingsystem pending
(acceptance) use facter to find the system name and fqdn

Earlier, tests used hostname -s and hostname -f to find the
fqdn and hostname on master. This checkin substitutes them with
facter fqdn and facter hostname