(#22956) Use a set to store tags

Tags were being stored in an array, which is inefficient as the number of tags
grows. This commit changes Puppet::Util::Tagging to store tags in a set. A new
class is added, Puppet::Util::TagSet, which subclasses the built in set while
allowing it to be compatible with the old serialization format.
(#22956) Remove temporary TagSet#== implementation
(Maint) Small cleanup to CA tests.
(Maint) Provide a timeout when trying to aquire a file lock

It is possible that the process is never able to aquire a lock. In that
case we don't want to block the process forever. There was also a
horrible performance characteristic from doing a busy loop while waiting
for the lock.
(#693) Test parallel certificate autosigning

This tests shows the case of multiple certificates being requested at
the same time with autosigning enabled. There are multiple different
ways that it fails: duplicate and lost serial numbers, attempts to
remove CSRs that have already been removed, incorrect file locking
(#693) Remove race conditions in autosigning code

This removes the autosigning attempt at signing all outstanding CSRs at
the same time, which removes contention between processes that are
submitting CSRs and then autosigning. It also properly locks and updates
the serial number file so that there is no more chance of duplicate
serial numbers.
(#693) Remove unused locking code, update timings

We don't need the import lock methods; however, the timings they used
make more sense than what we had originally. Some of the timing steps
have been brought over to the exclusive_open method.
(Maint) Move opening functionality to FileSettings

The FileSettings class should expose some behavior for interacting with
the file that the setting represents. This allows settings to become
smaller and the responsibilities to be better distributed.
(#693) Update spec tests for change impl

These tests are aggrevating. They are very tied to the implementation
and have almost not explanation of what features and behaviors are
available.
(Maint) Move write and writesub to Setting

Just like readwritelock, the write and writesub belong better on the
setting classes. This moves write to FileSetting as open and writesub to
DirectorySetting as open_file
(Maint) Update test to use proper class

The indirection actually returns a Puppet::SSL::Certificate and not an
X509 Certificate. The real certificate is available in the `content`
method of the puppet certificate.
Merge pull request #2008 from pcarlisle/performance/tagging

improve tag performance
(Maint) Use rand that is available on ruby 1.8.7

Random didn't appear until ruby 1.9.2, but the Kernel.rand has been
around for a long time and is on all of our supported ruby versions.
(#693) Format the SSL certificate instead of the wrapper

Puppet holds a wrapper around SSL certificates that we need to remove
before trying to format the certificate.
Merge pull request #2017 from zaphod42/issue/master/693-race-conditions-in-autosigning-csrs

(#693) Remove race conditions in autosigning code
(Maint) Pin windows gems to match what we ship

The win32-dir gem has a dependency on ffi, which was recently updated to
1.9.3 but does not provide a precompiled version. As a result, the gem will
attempt to compile native extensions, which will fail on our spec boxes
(since the dev kit is purposefully not installed).

This commit pins ffi to 1.9.0, updates win32-dir and windows-pr to the
version that we ship with, and pins each gem to an exact version matching:

https://github.com/puppetlabs/puppet-win32-ruby/tree/1.9.3/ruby/lib/ruby/gems/1.9.1/gems
(Maint) Unpend tests for certs on windows

The recent changes to how locks are handled made these previously
failing tests start working on windows!
(Maint) Properly mark test as unsuitable for windows

fork() doesn't exist on windows. I had tried to confine the test to not
run there, but did it wrong. This should fix it.
Merge remote-tracking branch 'upstream/stable'

* upstream/stable:
  (Maint) Pin windows gems to match what we ship
(#693) Update file handling to work on Solaris

It appears that solaris has different file semantics from OSX and Linux.

  * flock() is allowed on the same file from the same process. On linux
    this ends up with a block of the second invocation of flock().
  * flock() is not allowed on a file that is opened for read-only.
  * fopen() with "a" causes a read to occur at the end of the file. On
    linux the read is at the beginning of the file.