(Maint) Ensure that kick tests don't trigger an agent run

This commit fixes the infamous error that appeared periodically as:

````
  1) Puppet::Application::FaceBase#parse_options should stop if the first thing found is not an action
     Failure/Error: @logs.map(&:message).should == ["'basetest' has no 'banana' action.  See `puppet help basetest`."]
       expected: ["'basetest' has no 'banana' action.  See `puppet help basetest`."]
            got: ["Could not run Puppet configuration client: Not a directory - /dev/null/state/agent_catalog_run.lock", "'basetest' has no 'banana' action.  See `puppet help basetest`."] (using ==)
````

The error came from the spec for Puppet::Application::Kick, which tried
to test the error responses from the application calling Puppet::Run.
Unfortunately only one of the 4 tests actually stubbed out the call
which ends up invoking a puppet run via Puppet::Run.

The reason this was so hard to track down is that it only occured if the
thread that was created for the puppet run executed during the later
test and added a message into the log messages tracked in memory. To
find this the kick test and the face_base test were run repeatedly until
the error occurred.

In 2.7.x, this done using ruby 1.9 with the command:

$ rspec --tag "~@fails_on_ruby_1.9.2" spec/unit/application/kick_spec.rb
  spec/unit/application/face_base_spec.rb
Merge remote-tracking branch 'upstream/2.7.x' into 3.1.x

* upstream/2.7.x:
  (Maint) Ensure that kick tests don't trigger an agent run
Merge remote-tracking branch 'upstream/3.1.x'

* upstream/3.1.x:
  (Maint) Ensure that kick tests don't trigger an agent run
(#656) keep crontab from re-applying certain commands

The cron type allows arbitrary text in its command property.
The crontab provider will silently discard leading and trailing spaces
in record fields. Therefor, when parsing the generated records from disk,
the spaces appear to be missing.

To avoid this, it is safe to munge the command and discard the spaces
on the type level. The provider never gets to see them and will not
assume the need to refresh.
Merge pull request #1564 from ffrank/ticket/master/656-cron-dont-keep-refreshing

(#656) keep crontab from re-applying certain commands
(#15561) Extract CN from certificate subjects more carefully

When using certificate chaning or otherwise generating SSL certificates
outside of Puppet, the subject often has multiple components, e.g.,
  CN=hostname.foo.com,O=Foo\, Inc.,OU=Marketing
The hostname, which is later verified against a strict set of allowed
characters, is only extracted from the "CN" field, with all of the other
fields ignored.

This uses OpenSSL::X509::Name to parse the DN's, allowing both
rfc2253-formatted and openssl-formatted DNS, as seen from Apache and
nginx, respectively.
(#15561) Make implementation match spec examples

Without this patch applied, the following spec failure occurs.

    3) Puppet::Util::SSL when getting a CN from a subject should return nil for a bare string
       Failure/Error: described_class.cn_from_subject("/CN=foo").should == nil
       NoMethodError:
         undefined method `to_a' for "/CN=foo":String
       # ./lib/puppet/util/ssl.rb:23:in `cn_from_subject'
       # ./spec/unit/util/ssl_spec.rb:47:in `block (3 levels) in <top (required)>'

This failure is caused by the implementation of the `cn_from_subject` method
calling `to_a` on the string, which raises an exception.

This patch makes the implementation match the specified behavior by checking
for the `to_a` method.  If false, `nil` is returned as expected.
(#15561) Doc only YARD cleanup change
(#15561) Fix spec failure in certificate_request_spec

Without this patch applied, the x.509 CN extraction improvements cause
the following spec failure in the certificate_request_spec.rb file

      1) Puppet::SSL::CertificateRequest when converting from a string should create a CSR ...
         Failure/Error: described_class.from_s("my csr")
         NoMethodError:
           undefined method `to_a' for "/CN=Foo.madstop.com":String
         # ./lib/puppet/util/ssl.rb:23:in `cn_from_subject'
         # ./lib/puppet/ssl/base.rb:54:in `name_from_subject'
         # ./lib/puppet/ssl/base.rb:62:in `from_instance'
         # ./lib/puppet/ssl/base.rb:71:in `from_s'
         # ./spec/unit/ssl/certificate_request_spec.rb:42:in `block (3 levels) in <top (required)>'

Poor stubbing is the root cause of this problem.  The mock certificate
object returns a String from `#subject`, however the system expects a
kind of `OpenSSL::X509::Name`.

This patch addresses the problem by changing the mock object to return
an instance of `OpenSSL::X509::Name` when the mocked `#subject` instance
is called.
(#15561) Merge branch 'djmitche-bug15561-subject-fix'

* djmitche-bug15561-subject-fix:
  (#15561) Fix spec failure in certificate_request_spec
  (#15561) Doc only YARD cleanup change
  (#15561) Make implementation match spec examples
  (#15561) Extract CN from certificate subjects more carefully

closes #1556
Handle exceptions in verify_callback

These exceptions are otherwise ignored, with a message telling you the
exception was ignored but not actually telling you what the exception
was.
Merge branch 'djmitche-verify_callback_errors'

* djmitche-verify_callback_errors:
  Handle exceptions in verify_callback

closes #1561