Upgrade to Ring 1.1.1

Ring 1.1.1 contains the necessary changes to its servlet adapter to allow for
inspection of client-supplied SSL certificates. Upgrading also requires an
upgrade to Jetty 7. This required some changes in the handful of monkeypatches
we made to ring-jetty-adapter, though the new versions of ring obviate some of
them (ring now includes support for client-auth, so we no longer need to roll
our own).

The new version of Jetty pulls in its own version of various logging libraries,
and one of these conflicts with the version required by some of the other
libraries we're using. To resolve this conflict, I've excluded the problematic
library from each dependency that tries to fold it in itself, and instead
explicitly require a specific version.

Signed-off-by: Deepak Giridharagopal <deepak@puppetlabs.com>
Utility func for creating a lazy sequence of lines from a file

Signed-off-by: Deepak Giridharagopal <deepak@puppetlabs.com>
Funcs for extracting the CN from an x509 certificate

The JDK helpfully includes a set of classes for parsing x509 certificates and
RFC 2253 LDAP distinguished names, which makes extracting the CN
straightforward.

When encountering a DN with multiple CN's contained within, I opt for the
most-specific CN (which, according to the RFC, is the one that appears last).

Signed-off-by: Deepak Giridharagopal <deepak@puppetlabs.com>
(#14947) Restrict acceptable client certificates by CN

This patchset implements an optional whitelist for HTTPS clients. If
enabled by the user, we validate that the CN of the supplied client
certificate exactly matches an entry in the whitelist. This feature is
off by default.

This is implemented as ring middleware and a single, additional
configuration option. For plain HTTP connections, all clients are
allowed (as no client certificate will be present).

Signed-off-by: Deepak Giridharagopal <deepak@puppetlabs.com>
Acceptance tests for certificate whitelisting

Signed-off-by: Deepak Giridharagopal <deepak@puppetlabs.com>
Use correct puppetlabs-release package for platform

This used to be a single package, but now is platform-specific. So we'll
use lsb_release to figure that out and install the right one.
Merge pull request #206 from nicklewis/use-correct-puppetlabs-release-package

Use correct puppetlabs-release package for platform
Merge pull request #191 from grimradical/client-cert-restriction

Client whitelisting
(#15075) Improve handling of service start/stop during rpm upgrade/uninstall

Prior to this commit there were a few issues with the way we were
handling interacting with the system's puppetdb service during
rpm upgrade and downgrade.  Basically, we were *always* stopping
(and disabling) the service whenever an uninstall occurred; however,
during an upgrade, rpm does an install of the new package followed
by an uninstall of the old package.  We weren't treating this
situation differently, so the service was being stopped.  This
commit does the following:

* On uninstall, we now check to see if this is part of an upgrade
  or not, and we only stop and disable the service if this is
  *not* part of an upgrade.

* On upgrade, we stop the service before we install the new package,
  and restart it after we finish removing the old package.