Add example external CA data provided by Dustin Mitchell

Without this patch applied we don't have an easy way to create a set of
CA and SSL certificates that are representative of how end users are
currently using external CA's with Puppet.

This is a problem because we're left to guess how users are using Puppet
while trying to support external CA's.

This patch adds additional data created by Dustin's `certchain.sh`
script which are not being actively used in the acceptance tests.
They're included in Puppet in an effort to reduce roadblocks to
augmenting the existing acceptance tests.
Add PuppetX::Acceptance::ExternalCertFixtures class

This patch adds the static fixture data that is explicitly used by the
ExternalCertFixtures class.  This class will make the fixture data
located in the filesystem available to the acceptance test itself.
(#15561) Add External CA acceptance test

This patch adds three acceptance tests:

  1: Externally issued certificate chains work.
  2: Email addresses in certificate names work.
  3: Certificate revocation works.

              +-----------------+
              |     Root CA     |
              |  (Self Signed)  |
              +--+------------+-+
                 |            |
           +-----+            +------+
           |                         |
           v                         v
    +-------------+            +------------+
    | Issuing CA  |            | Issuing CA |
    | For Masters |            | For Agents |
    +-------+-----+            +------+-----+
            |                         |
            |                         |
            v                         v
    +-------------+            +-------------+
    | Master SSL  |            | Agent SSL   |
    | Certificate |            | Certificate |
    +-------------+            +-------------+

A master may restrict clients to those with a certificate issued by a
specific DN.  For example, the Apache `SSLRequire %{SSL_CLIENT_I_DN_CN}
== "Agent CA"` directive will only allow agent with certificates issued
by "Agent CA"

These examples exercise Puppet agents checking for revoked master
certificates by populating a CRL file out of band.

Finally, subject names with email addresses in the name are checked in
an effort to prevent regressions on #15561.  For example,
`CN=agent-email3.example.org/emailAddress=test@example.com`.

This fixture data is intended for, and supported on, EL-6 master hosts
with Apache 2.2 or later and Passenger 3.0.17 from EPEL.

This test is confined to the `el-6` platform.

Expected output on the agent when the master certificate has been
revoked is:

    Error: Could not retrieve catalog from remote server:
    SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed:
    [certificate revoked for /CN=master1.example.org]
    Error: Could not retrieve catalog; skipping run
Remove ServerName from Apache Virtualhost

I'm including this small patch because this mis-configuration caused
quite a bit of hurt for me.

Without this patch applied, both virtual hosts running on 8140 and 8141
use the same SSL certificate, the one configured in 8140.  This is a
problem because the second, 8141, virtual host is configured to use a
different certificate that is intended to be rejected by the agent.

Because the first cert is being used the agent does not know to reject
the connection.  This, in turn, caused a false-positive success in the
acceptance test that validates an agent refuses to connect to a rogue
master.

This patch fixes the problem by removing the ServerName statements
included in the virtualhost blocks.  With these statements removed from
the configuration the server on 8140 presents a cert issued by the
Master CA and the server on 8141 presents a cert issued by the Agent CA,
as expected.
(maint) Clean up the httpd.conf used in testing
(#20027) Add acceptance test for ssl_client_ca_auth
(#20027) Spec examples of how ssl_client_ca_auth behaves
(#20027) Fix ssl_client_ca_auth validation

Without this patch applied the `ssl_client_ca_auth` setting does not
cause the behavior documented with the option.

The expected behavior is that the agent should refuse to connect to a
Puppet master which presents a SSL certificate whose chain does not
include a certificate listed in the `ssl_client_ca_auth`.

This patch addresses the problem by scanning through the peer
certificate chain, checking each certificate in the chain against the
set of certificates listed in the `ssl_client_ca_auth` file.  If this
setting is not configured then the `localcacert` file is used instead,
which should be the root, self signed certificate in default
configurations.
(#20027) Refactor connection verify_callback Proc

Without this patch the Proc assigned to `Net::HTTP#verify_callback=` is
difficult to test.  This is a problem because this Proc handles critical
behavior related to authorization and security.

This patch addresses the problem by extracting the anonymous proc into a
class named Puppet::SSL::Validator.  The #call method implements the
Proc API and behaves in the same manner as the anonymous Proc.

This patch also adds explicit behavior tests to cover the #call method
and related authorization checking methods.
Merge branch 'external_ca_support'

* external_ca_support:
  (#20027) Refactor connection verify_callback Proc
  (#20027) Fix ssl_client_ca_auth validation
  (#20027) Spec examples of how ssl_client_ca_auth behaves
  (#20027) Add acceptance test for ssl_client_ca_auth
  (maint) Clean up the httpd.conf used in testing
  Remove ServerName from Apache Virtualhost
  (#15561) Add External CA acceptance test
  Add PuppetX::Acceptance::ExternalCertFixtures class
  Add example external CA data provided by Dustin Mitchell

closes #1572