validate operations/puppet submodules

We have recently started hosting some new submodules which were lacking
puppet parser validation and erb linting.  This patch creates:

* a macro to parse any .pp file changed in HEAD
* an associated job template to easy add puppet validation
* jobs for ops/puppet/{cdh4,kafka}

bug: 48590
Change-Id: I66fca52afc87b00b7d77ff4adead2547211a39db