Deprecate IP-based authentication

This will need to be made explicit in a future version, so it's good to
get people to stop using it if possible.
Add Selector terminus for file_content/file_metadata

This terminus is now the default, and encapsulates the behavior that was
previously in the IndirectionHooks. That is, we dynamically select the
terminus to use for a file request based on the key. However, for the
puppet master, we instead explicitly always use the FileServer terminus,
so that *all* requests for files from the master will go through
the file server. This ensures that we will never accidentally
serve local files on the puppet master.
Reject file requests containing ..
Fail more gracefully when finding module files if no file is specified

Previously this would just complain about trying to call `nil.split`.
Always use the local file_bucket on master

This fixes an issue where the master could be made to issue arbitrary
HTTPS requests through carefully constructed URLs. Now the master will
always use the file_bucket, whereas other applications retain their
behavior of dynamically selecting the source (rest or file) based on the
particular request.
Use head method to determine if file is in file bucket

This call was using find, but wasn't doing anything with the result,
only checking whether the file existed. Using head here is more
semantic and saves the trouble of reading the file if it does
exist.
Fix whitespace inside parentheses
Add specs for selector terminuses of file_{content,metadata}
Validate CSR CN and provided certname before signing

This adds a few new checks when signing CSRs, to validate the CN. First,
it must conform to a small set of characters, which are the printable
ASCII characters, except for '/' (because we store these in files). This
prevents attacks such as a CN "foo^H^H^Hbar", which appears as "bar" to
"puppet cert list".

The other check is that the certname for the SSL::Host that we think
we're signing must match the CN. This prevents a CSR with the CN "foo"
from being submitted as a CSR for "bar", which would cause it to appear
as "bar" to "puppet cert list", but to issue a certificate for "foo".
Don't allow the creation of SSL objects with invalid certnames

This ensures we catch invalid certnames earlier in the process, such as
when an agent is starting or making a certificate request, rather than
at the very last step of signing the request. This should make for
better error messages to the user.
Use "inspect" when listing certificates

This fixes an issue of `puppet cert list` potentially not accurately
depicting the actual certname of the certificate/request. For instance,
"foo^H^H^Hbar" would simply appear as "bar".
Tighten permissions on classfile, resourcefile, lastrunfile, and lastrunreport.
Merge branch 'file-server-2.7.17' into security_fixes_2.7.18
Merge branch 'deprecate-ip-authentication-2.7.17' into security_fixes_2.7.18
Merge branch 'clean-permissions-2.7.17' into security_fixes_2.7.18
Reject directory traversal in store report processor
Merge branch 'store-report-processor' into security_fixes_2.7.18
Update CHANGELOG lib/puppet.rb conf/redhat/puppet.spec for 2.7.18
Merge remote-tracking branch 'cve/2.7rc' into 2.7.x

* cve/2.7rc:
  Update CHANGELOG lib/puppet.rb conf/redhat/puppet.spec for 2.7.18
  Reject directory traversal in store report processor
  Tighten permissions on classfile, resourcefile, lastrunfile, and lastrunreport.
  Use "inspect" when listing certificates
  Don't allow the creation of SSL objects with invalid certnames
  Validate CSR CN and provided certname before signing
  Add specs for selector terminuses of file_{content,metadata}
  Fix whitespace inside parentheses
  Use head method to determine if file is in file bucket
  Always use the local file_bucket on master
  Fail more gracefully when finding module files if no file is specified
  Reject file requests containing ..
  Add Selector terminus for file_content/file_metadata
  Deprecate IP-based authentication