(#18931) Add setting to control how remote metadata is copied

WTF, this is wrong, this needs to be a file parameter

Previously, when puppet applied a file resource with a remote source,
e.g. `source => 'puppet:///...', it would always copy the owner, group,
and mode values from the remote file to the local file, even if those
properties were not being managed.

This affected both newly created files (#5240) and modifying existing
ones (#18931). This behavior goes against puppet's principle of only
managing properties of the resource that are specified in the manifest.

The behavior has security implications on Unix, as there are no guarantees
that the uid/gid on the remote system refer to the same accounts on the
local system. It also has security implications on Windows, due to
puppet breaking filesystem inheritance. However, this behavior has
existed since at least 0.25.0.

This commit adds a setting `source_permissions` whose values are
`always`, `creates`, or `never`, where `always` corresponds to the
existing behavior, and is the default. The `creates` value will cause
puppet to only copy owner, group, and mode from the remote site when
creating the file resource (file, directory, or link), but not when
managing an existing file. The `never` value will cause puppet to never
copy owner, group, and mode from the remote side.

Note that if you specify an owner, group, and/or mode property in the
manifest, then that will always managed and take precedence over the
remote values.
(#18931) Make non-root puppet not set group on files.

Previously there was code so that non-root puppet would not
atttempt to set owner on files (makes sense).  The same logic
applies to group, so this patch simply extends that same code
so that non-root puppet doesn't attempt to set group on files.
(#18931) Convert source_permissions from Puppet setting to file param
(#18931) Refactor slightly for readability

Minor cleanup:
* be consistent about accessing resource member sans @
* refactor copy_source_values for readability
* mark two methods private
(#18931) Replace 'puppetmaster' with 'puppet master'
(#18931) Rename source_permissions param values

After some discussion with Nick, this patch renames the three
values of the source_permissions:
* always -> use
* creates -> use_when_creating
* never -> ignore

The concern with the previous names is that 'always' and 'never'
might mislead a user to think that this overrode managed values
for owner/group/mode, when in fact the source_permissions param
only refers to behavior for *unmanaged* values.  So 'use'/'ignore'
don't carry that absolute implication while still describing the
behavior.  'use_when_creating' is a little long and awkward, but
also expected to be the least used option.
(#18931) Convert the mode to a string for consistency.

In commit 3e592777 file modes were converted from an integer
to an octal string, but missed this one location.  For those of
us who don't convert octal to decimal immediately, this was
confusing.  This patch uses strings for mode consistently,
at least within this file.
(#18931) Extend tests for local

Add tests to verify that local trumps source_permissions across the board.
Add verification that the mode is copied for local sources.
Merge pull request #2084 from hlindberg/issues/issue-19514

(#19514)(PP-773) Rename hashed_node_data and cliencert for $trusted
(Maint) Add memory terminii for CR and Key

These are sometimes useful in tests when we don't want to deal with
saving the certificates to disk, but will want to allow them to be saved
somewhere.
(#23116) Provide pluggable SSL verification

This provides the ability to create a verifier for SSL connections
opened with puppet's Puppet::Network::HTTP::Connection. The verifier is
provided the Net::HTTP connection and it just needs to configure it for
the correct verification mode.

The new functionality can be used when puppet's standard SSL
verification rules are not suited to the needs of the caller. The
impetus for this was a requirement that a connection be able to be made,
the certificates checked, but the subject and alt name checks skipped.
Rather than put that directly into puppet, this allows a new validator
to be written that performs those checks.
(#23200) Add method for checking if one OID contains another
(#23200) allow certificate factory to add custom exts
(#23200) Whitelist puppet extension requests
Merge pull request #2088 from adrienthebo/feature/ca-extreq-whitelist

feature/23200 Copy whitelisted extensions from CSRs to certs
(maint) Remove misleading comment regarding msExtReq

Puppet has never provided a way to add microsoft extension requests to
generated CSRs, so it's not something we would necessarily restore. This
commit removes a comment that indicates that we used to support
msExtReq.
(#23201) Allow CSRs to return multiple extension requests
(#23201) Extract CSR extension_request attr generation
(#23201) allow custom fields to be added to CSR extReq
(#23201) don't assign OIDs when looking up extension requests

The `Puppet::SSL::CertificateRquest#subject_alt_names` method was trying to
select all of the subjectAltName extensions in the extension requests,
but was accidentally assigning that OID to all extensions instead of
comparing them.

Before 63cecc56 subjectAltName was the only possible extension request so
this was innocuous, but following that commit this error was destructive.
This commit resolves the issue by using the comparison operator instead
of assignment.