(Maint) Add memory terminii for CR and Key

These are sometimes useful in tests when we don't want to deal with
saving the certificates to disk, but will want to allow them to be saved
somewhere.
(#23116) Provide pluggable SSL verification

This provides the ability to create a verifier for SSL connections
opened with puppet's Puppet::Network::HTTP::Connection. The verifier is
provided the Net::HTTP connection and it just needs to configure it for
the correct verification mode.

The new functionality can be used when puppet's standard SSL
verification rules are not suited to the needs of the caller. The
impetus for this was a requirement that a connection be able to be made,
the certificates checked, but the subject and alt name checks skipped.
Rather than put that directly into puppet, this allows a new validator
to be written that performs those checks.
(maint) Remove misleading comment regarding msExtReq

Puppet has never provided a way to add microsoft extension requests to
generated CSRs, so it's not something we would necessarily restore. This
commit removes a comment that indicates that we used to support
msExtReq.
(#23201) Allow CSRs to return multiple extension requests
(#23201) Extract CSR extension_request attr generation
(#23201) allow custom fields to be added to CSR extReq
(#23201) don't assign OIDs when looking up extension requests

The `Puppet::SSL::CertificateRquest#subject_alt_names` method was trying to
select all of the subjectAltName extensions in the extension requests,
but was accidentally assigning that OID to all extensions instead of
comparing them.

Before 63cecc56 subjectAltName was the only possible extension request so
this was innocuous, but following that commit this error was destructive.
This commit resolves the issue by using the comparison operator instead
of assignment.
(#23201) Expose custom extensions in the certificate

Certificates generated by the Puppet CA come with a number of standard
extensions, but users may want to create certs with custom extensions
and then retrieve them later. This commit adds a mechanism for adding
extension requests to the CSR from the csr_attributes file and exposes
custom extensions on the signed certificate.
(#23116) Make SSL Validator API more explicit

This refactors the API with an abstract superclass that contains
the API documentation and two factory methods; to obtain the no
validation implementation, and the default implementation.

Yardoc reworked.
Merge pull request #2091 from jpartlow/feature/23201/csr-extension-requests

Feature/23201/csr extension requests
(Maint) Trailing comma doesn't work in ruby 187

Ruby 19 accepts trailing commas in method argument lists, but its a
syntax error in ruby 187.
Merge pull request #2093 from hlindberg/feature/issue-23116-allow_certificate_verification_post_factum

(#23116) Provide pluggable SSL verification
(Maint) Remove unstable and not useful test

This entire test often failed, or hung, because of networking problems.
We get coverage for what it is doing either through unit tests or
through full-system tests that run the webrick server.
(Maint) Conform to naming conventions

Two factory methods had been created that ended up following CamelCase
naming. This is ruby, man! We name with underscores here!
(Maint) Eliminate Windows network lookups

When using a UNC style file path, the windows file provider invokes
File.expand_path('//server/...'), which results in a failed Windows
network lookup. Executing these two tests was previously taking 15.4
seconds.

This commit instead provides a `localhost` server to short-circuit the
lookup. The tests now only take 1.7 seconds.
(#11563) Model Windows security descriptors

Creates objects for modeling windows security descriptors, access control
lists, and access control entries.
(#11563) Refactor DACL parsing

This commit moves the parsing of the DACL into a separate method,
so that it is not coupled with the loading of the DACL.
(#11563) Only rewrite the DACL if the mode changes

Previously, the owner, group, mode getter and setter methods each managed their
part of the security descriptor. This lead to similar, but slightly different
methods, such as GetSecurityInfo being invoked once to get the owner, and
another time to get the dacl.

This commits adds methods for getting and setting the security descriptor,
and updates the owner/group/mode methods to call it. This eliminated duplicate
logic many places, e.g. change_sid, get_sid, set_acl, get_dacl, get_dacl_ptr,
get_security_info, and set_security_info.

This commit also means that if you change the owner and/or group, but not mode,
then the security descriptor will not be marked as protected, and the DACL
will not be rewritten. In other words, puppet won't mess up your file
permissions.

Only if you choose to manage the mode will puppet mark the SD as protected and
rewrite the DACL based on the security descriptors owner/group and specified
mode.
(#11563) Preserve deny ACEs

Previously, puppet would warn if it encountered a deny ACE, and ignore it.
This is a problem now, because we need to be able to accurately round-trip
an ACL when modifying the owner/group.

This commit modifies the DACL parsing code to return the deny ACE in the
returned ACE.
(#11563) Use Windows security descriptor methods

Previously, we were representing ACEs as a hash, which was fine for simple
sid & mask entries. But it's more complicated now that we need to keep
track of flags and ace types, and test whether an ace is inherited or not.

This commit updates the code to use the appropriate AccessControlList#allow
and #deny methods when building a DACL. It also uses the SD, ACL, and
ACE instance methods when setting the permissions on the file.