(#21243) Allow puppet service to run as a local or domain account

Previously, the puppet windows service always ran as the LocalSystem account, which is fairly standard for agents that need to install arbitrary packages, modify file permissions, etc.

However, the LocalSystem account does not have any credentials with which to access network resources, e.g. SMB network shares. As a result, the standard way of handling this is to run the service under a domain service account, and add the service to the local administrators group on the computer.

This commit allows the service domain, account and password to be specified. The account must already exist. The installer will grant the logon as a service right to the account, and will add the account to the local Administrators group.

If the account does not exist, the install will fail. If you've enabled logging, e.g. /l*v install.log, you should see:

    Error 0x80070534: Failed to get SID for user: .\albert

If the password is wrong, the install will fail with:

    Error 1920. Service 'Puppet Agent' (puppet) failed to start.
    Verify that you have sufficient privileges to start system services.

**If the service is currently running as something other than LocalSystem, then you must re-specify the credentials when installing a new version. Otherwise, the service will revert back to the default LocalSystem account.**

By default, the installer assumes the account is local, or you can specify the domain as either

    PUPPET_AGENT_ACCOUNT_DOMAIN=.
    PUPPET_AGENT_ACCOUNT_DOMAIN=%COMPUTERNAME%