(#593) parsedfile: add support for native file headers

Some managed configurations (notably the vixie cron crontabs) are
automatically prefixed with headers not unlike those generated by
puppet providers themselves. This can lead to "mutual 1up" situations
in which puppet and the third party software will insert header upon
header in their respective output.

This change introduces the a "native header" for a parsed file. Providers
can define a regex object that will be used to identify the part of a parsed
file that comprises such a vendor header.

When writing the content back to disk, puppet will try and insert
its own header underneath the vendor's headers. Additionally, providers
can override a "drop native headers" field in order to have puppet
skip the vendor header alltogether when writing file contents. This allows
"smart" software like vixie cron to manage its header on its own.

The unit tests are based on example code kindly provided by Jeff McCune.
(#593) crontab: drop vixie cron headers when writing crontabs

This makes use of the "native header" of parsed files.

Vixie cron headers should never be written back to disk, because
cron will insert a new header, regardless of what's found in the
temporary input file.

The underlying issue is a cron bug, because vixie headers should
(probably) not appear in `crontab -l` output. This is indeed fixed
in newer versions of cron, so this workaround merely introduces
compatibility with older systems.
Merge branch 'pull-1479'
Merge remote-tracking branch 'pr/1480' into 2.7.x
Merge branch '2.7.x' into 3.0.x
Merge branch '3.0.x' into 3.1.x
Merge branch '3.1.x'
Merge pull request #1442 from jjulien/feature#7911

(#7911) Allow managing local groups when duplicate names exist in a remote NSS database e.g. LDAP.
Explicitly cast Pathname in Puppet::Util#replace_file

Puppet::Util#replace_file contains a call to File#rename
where one of the arguments is of type `Pathname`.  The
actual method signature requires two String arguments,
and JRuby does not appear to implicitly cast in this
situation--so all calls to `replace_file` were failing
on JRuby.  This commit simply makes the cast explicit.
(#18781) Be more tolerant of old clients in WEBrick server

In #18781 and #6117 there are cases of relatively simplistic puppet
setups failing between old versions of the puppet client (which
always use HTTP GET) and new versions of the puppet WEBrick server
(which has a relatively low limit on the size of a valid GET: 2083
bytes).

While there are other non-WEBrick server options available, WEBrick
has the advantage of simplicity, so it would be nice to keep it working.

Here we patch the WEBrick constant which specifies the maximum size of
a HTTP GET request, increasing it to a value that should work for common
setups.
(#19323) ext/systemd: adding a way to specify cmd line options

This patch adds a way to easily specify extra command line options for
both puppetagent and puppetmaster services when starting them with
systemd.

It removes ExecPre command as the directory creation is now handled by
the RPM install.

Previously there was no way to pass in valid puppet agent/master command
line parameters like '--config=/etc/puppet/puppetmaster.conf', etc. A
lot of people use separate config files for the agent and the master
services.

To make it somewhat consistent I added a systemd supported way to read
environment variables from a file '/etc/sysconfig/<servicename>', so
people who use extra cmd line options already will be able to do that with
systemd as well.

When services are started by systemd, systemd will read the files which
contain the below variables and will pass their values when starting
puppet services (I used the same variable names as it's been used in
redhat-like distros already):

PUPPET_EXTRA_OPTS in /etc/sysconfig/puppetagent
PUPPETMASTER_EXTRA_OPTS in /etc/sysconfig/puppetmaster
Merge pull request #1483 from cprice-puppet/bug/master/replace_file_jruby_fix

Explicitly cast Pathname in Puppet::Util#replace_file
Merge pull request #1487 from vaijab/fix/master/cmd_line_opts_with_systemd

(#19323) ext/systemd: adding a way to specify cmd line options
Merge pull request #1478 from dsd/fix/master/18781-webrick-old-client-compat

(#18781) Be more tolerant of old clients in WEBrick server
Merge pull request #1477 from dalen/ssl_error

(#19271) Proper check for which cert to use in ssl error
(maint) Use MatchData object over ruby global vars

The implementation for native file headers for the ParsedFile providers
made use of the Perl style global variables like $`, $', and $&. These
are difficult to understand at first glance and equivalent behavior is
provided by MatchData objects. This commit removes the global variables
with a MatchData object for clarity.
(#19393) Safely load YAML from the network

When using Psych (only available in Ruby 1.9), YAML.load may in certain
cases (!map: and !ruby/hash: tags) use the initialize and []= methods to
create objects. These methods could potentially allow arbitrary code to
be executed. We now add a safely_load method which parses the input
first, checks it for dangerous tags, and fails if they are found. If the
input is clean, we transform the result (as YAML.load would have done)
and go on our merry way.

This change is only applied to YAML coming in either HTTP requests or
responses. YAML from the local system is trusted, as anyone who can
write that YAML could do damage some other way.
(#19393) Safely load YAML from the network

When using Psych (only available in Ruby 1.9), YAML.load may in certain
cases (!map: and !ruby/hash: tags) use the initialize and []= methods to
create objects. These methods could potentially allow arbitrary code to
be executed. We now add a safely_load method which parses the input
first, checks it for dangerous tags, and fails if they are found. If the
input is clean, we transform the result (as YAML.load would have done)
and go on our merry way.

This change is only applied to YAML coming in either HTTP requests or
responses. YAML from the local system is trusted, as anyone who can
write that YAML could do damage some other way.
Merge remote-tracking branch 'puppet-cve-test/safely-yaml-3.1.0' into security/3.1.0/february_code_orange

* puppet-cve-test/safely-yaml-3.1.0:
  (#19393) Safely load YAML from the network
Merge pull request #1489 from adrienthebo/maint/master/parsedfile-human-readable-match-variables

(maint) Use MatchData object over ruby global vars