(#23222) Custom CSR attributes should only contain strings

RFC 2985 indicates that CSR attributes may contain arbitrarily complex
data, but the `openssl req` command can only handle attributes with
string values. This commit changes the csr attribute structure to simple
key/value pairs so that the attributes are properly displayed by
OpenSSL. If richer data types are need then data can be serialized as
JSON or YAML and added as a CSR value.
(#15559) Windows security test fails under SYSTEM

 - Previously get_mode spuriously included the S_ISYSTEM_MISSING bit when
   the group or mode was SYSTEM
 - Behavior has been adjusted in integration/type/file_spec.rb so that
   when the current user is SYSTEM (like in a build server environment),
   it's verified that there is at least one SYSTEM ACE that has FULL
   access.  When running under SYSTEM there may be many SYSTEM ACEs,
   including inherited ones.
 - In some cases, owner group or mode has been set to something that
   can more legitimately setup our initial desired pre-test state.  When
   verifying that SYSTEM is granted FULL access, it's important that
   SYSTEM not be assigned to the group or owner.
 - Some tests have been marked pending where it's trickier to setup the
   appropriate initial state when running the tests as SYSTEM.  These
   will be resolved when new security descriptor code is introduced.
Merge remote-tracking branch 'ethan/ticket/master/15559-dont-remove-windows-SYSTEM-permissions'

* ethan/ticket/master/15559-dont-remove-windows-SYSTEM-permissions:
  (#15559) Windows security test fails under SYSTEM
Merge pull request #2096 from adrienthebo/defect/23222/string-csr-attributes

(#23222) Custom CSR attributes should only contain strings
Merge branch 'master' of https://github.com/puppetlabs/puppet