(#21971) Create test to show exploit of resource_type

This test creates a file in the tmp directory on the master, opens up
access to the resource_type endpoint, and then makes a request that
causes the file placed in tmp to be evaluated. If the exploit works,
then a file is placed in /tmp on the master.
(#21971) Add test for accessing based on master being at root

The master process, when it daemonized, switches the current working
directory to /. This means that all paths are easily knowable by a user
and no directory traversal is needed to get to any file on the file
system. The type loading code does not protect from this by making sure
that any types that are requested only appear in the known-good
directories (the manifest dirs in the modulepath) and so can be caused
to load code from anywhere on the system.
Merge branch 'stable'

* stable:
  (#21971) Add test for accessing based on master being at root
  (#21971) Create test to show exploit of resource_type
Merge branch 'master' of https://github.com/puppetlabs/puppet