wrap file copy in umasks to secure permissions

* salt.util.copyfile needs preceding with 54 (aka 0066) umask in order
  for new files to correctly get 0600 mode permissions.
* shutil.copyfile is preceded by a 63 (aka 0077) umask.

Fixes issue #8590
Add pkgrepo tests for CentOS

Ubuntu ones will follow soon.
Update wheen return api for consistency
Fix pkgrepo tests when python file is run by itself on CLI
Remove grains requirement

I had this code here in an early draft of this test, but the grains are
no longer needed here as the stuff that requires grains has been moved
out of the test function and into the SLS files that are run by the
test.
Add an assert to ensure that the state.sls return dict isn't empty
Start on writing tests tutorial
Renamed `__state__` to `__low__`.
remove test for issue #8976 closed as expected behavior
Comment tests for closed issue #8802
Merge remote-tracking branch 'upstream/develop' into requisites-tests
Fix two bugs in keystone module

(1) If a profile was passed to keystone.auth(...), it loaded values
    from the configuration profile specified, but then immediately
    overwrote them.

(2) The same method function set kw_args[True] = True, rather than the
    intended kw_args['insecure'] = True
Fix #8773: allow syntax error state.foo in requisites with a warning.
Additionally pass the running and the `lowstate` dicts.

Additionally bring the running and the `lowstate` dictionaries into the state function global context.
Merge pull request #8822 from regilero/requisites-tests

Remove use inheritance Requisites tests
Minor typo fixes.
Default values for `chunks` and `running` should be `None`.

Refs the `state.low` and `state.high` salt module functions which do not have, not provide such context.
Save CPU cycles on the deep copy calls.
Merge pull request #8825 from s0undt3ch/develop

Minor typo fixes.
Merge pull request #8824 from tibbes/fix-keystone-auth

Fix two bugs in keystone module