(maint) Add specs for parser resource parameters

Classes Puppet::Parser::AST::ResourceParam and Puppet::Parser::Resource::Param
(#23115) Include manifest context in Puppet::DevError

When a 'devfail' or Puppet::DevError is thrown, include the user's manifest
file/line context as it can help in finding the problem.
(#23115) Convert nil resource parameter values to undef

If a resource parameter evaluates to nil (e.g. a return value from a parser
function), then convert the value to undef.  This prevents an error in
Puppet::Parser::Resource::Param which requires a non-nil value on
instantiation.
(maint) Add ruby-augeas to Gemfile and Travis for more test coverage
(#23141) Add OpenBSD to the exclusion list for 'remounts' in mount type
On systems without "-o remount", use "-o update" except for AIX.
(Maint) Allow acceptance tests to be run on preserved windows hosts

Previously, running acceptance tests on a preserved windows host would
fail, because the puppet-win32-ruby directory already existed from the
previous run, and git clone will report a fatal error.

This commit uses beaker's method for cloning a repo. The method handles
things like only cloning if necessary, resetting remotes, and cleaning
existing workspaces.
(#18931) Add setting to control how remote metadata is copied

WTF, this is wrong, this needs to be a file parameter

Previously, when puppet applied a file resource with a remote source,
e.g. `source => 'puppet:///...', it would always copy the owner, group,
and mode values from the remote file to the local file, even if those
properties were not being managed.

This affected both newly created files (#5240) and modifying existing
ones (#18931). This behavior goes against puppet's principle of only
managing properties of the resource that are specified in the manifest.

The behavior has security implications on Unix, as there are no guarantees
that the uid/gid on the remote system refer to the same accounts on the
local system. It also has security implications on Windows, due to
puppet breaking filesystem inheritance. However, this behavior has
existed since at least 0.25.0.

This commit adds a setting `source_permissions` whose values are
`always`, `creates`, or `never`, where `always` corresponds to the
existing behavior, and is the default. The `creates` value will cause
puppet to only copy owner, group, and mode from the remote site when
creating the file resource (file, directory, or link), but not when
managing an existing file. The `never` value will cause puppet to never
copy owner, group, and mode from the remote side.

Note that if you specify an owner, group, and/or mode property in the
manifest, then that will always managed and take precedence over the
remote values.
(#18931) Make non-root puppet not set group on files.

Previously there was code so that non-root puppet would not
atttempt to set owner on files (makes sense).  The same logic
applies to group, so this patch simply extends that same code
so that non-root puppet doesn't attempt to set group on files.
(maint) Don't stand up master unless resigning.

Don't take the time to bring up a puppet master unless we intend to
recreate certs.

Also clears and resets the master's cert if it has the agent role.
There is no reason to treat the master specially in this case.
(#7243) Allow CSRs to accept a set of custom attributes

When a CSR is generated, additional information may need to be attached
to the CSR for use when the CSR is signed. This commit allows an
additional hash of OID/value pairs to be included as CSR attributes when
the CSR is generated.

To ensure that user specified attributes cannot overwrite attributes
added by Puppet itself, adding attributes that deal with certificate extension
requests will fail the CSR generation process.

Original patch by Patrick Hemmer <patrick.hemmer@gmail.com>
Merge pull request #2078 from jpartlow/feature/7243/csr-attributes-test

Feature/7243/csr attributes test
(#23183) Use FFI to manage pointers in RootCerts module

Previously, we made assumptions about the layout of the CERT_CONTEXT
structure, specifically that PCERT_INFO (pointer to CERT_CONTEXT) was an
unsigned 32-bit integer ('L'), and magically accessed the size of the
returned structure as arr[2]. We were also memcpy 40-bytes which was
larger than the size of the CERT_CONTEXT structure in both x86 and x64 and
was the cause of infrequent segmentation faults.

This commit uses FFI to define the layout of the CERT_CONTEXT structure, uses
named fields, e.g. [:cbCertEncoded], to access offsets within the structure,
and uses the FFI::Pointer#null? method to check for NULL pointer.

Note that we use FFI::Pointer and not MemoryPointer, because the
CertEnumCertificatesInStore function is responsible for freeing the
previous CERT_CONTEXT pointer, not us.

Also in the motto of "don't stub what you don't own" it exercises the Win32
APIs to make the tests more meaningful.
Merge pull request #2049 from domcleal/tickets/master/23115-param-nil

(#23115) Convert nil resource parameter values to undef.
Merge pull request #2079 from joshcooper/ticket/stable/23183-ffi-rootcerts

(#23183) Use FFI to manage pointers in RootCerts module
Merge branch 'stable'
(#18931) Convert source_permissions from Puppet setting to file param
(#7244) Consolidate autosign setting

Previous implementation split out a new autosign_command setting for the
custom policy executable, which required a confusing autosign=false
setting.

This commit removes the autosign_command setting and instead uses the
autosign setting for all modes (true/false, autosign.conf or custom
policy executable).  Internally we refactor to distinguish between
autosign.conf or an executable by the executable bit.

We are removing the mode of the autosign setting, because it was
stripping all executables of their executable bit.  This only removes
the guarantee that group and other do not have write permissions.
However, these are the default permissions for a regular file on most
systems, so nothing should be lost.
(Maint) Introduce partial implementation of an In-Memory file

Quite often in tests we want to work with a "file", but not actually
deal with the file system. We usually do that by mocking out all sorts
of things on File and FileUtils and Dir and various other places. Now
that we have Puppet::FileSystem::File (and maybe at some point in the
future we'll have Puppet::FileSystem::Store to represent the actual
storage system, what we normally call the filesystem itself) we can
create different kinds of files.

This adds Puppet::FileSystem::MemoryFile, which, so far, only partially
implements the methods on Puppet::FileSystem::File and addes 3 methods
to Puppet::FileSystem::File to allow us to easily create a view onto the
filesystem: overlay, remember, forget.
(#7244) Fix up tests after refactors of the Autosign system

The refactoring of the Autosign system changed its interaction with the
filesyste. This fixes up the tests to work with the new interactions and
hopefully be more robust to future changes.