Adds protection against injection attacks to the nodejs layer

The nodejs layer of the Razor back-end was wide open to injection attacks. Not
only did all commands perform shell expansion of the command line, some paths
where also directly mapped to the file system without first checking if they
contained '..' segments. I had no problems letting Razor server up my private
ssh key for instance. This commits adds some code to prevent injection attacks
from happening. It consist of the following:
1. All calls to exec() has been replaced by calls to execFile() to avoid shell
   expansion.
2. When the execFile results in errors, those errors are now handled. They
   were previously ignored.
3. Splitting, decoding, and validation of request path was refactored into one
   function.
4. A new exception type InvalidURIPathError was introduced.
5. All path segments are checked for length (<200 characters) and validated
   with a regexp that ensures that they don't contain any control characters.
6. Several tests were added to verify that some known types of injection
   attacks are trapped.
Prevents web access to the Razor config

One of the points in the security assessment of Razor was
"Unauthenticated access to Razor configuration file".

This commit ensures that this file cannot be accessed using
the web interface by letting the Ruby CLI preventing access
to the 'config' slice for all calls using the -w flag.

A new flag, '-j' was introduced to enable the nodejs layer
to obtain the config in json format. The Ruby CLI will block
all attemts to combine the -w and -j flags.

The prevention check was added to the Ruby layer rather than
in the nodejs layer for two reasons:
1. There are ongoing discussions about replacing nodejs.
2. The check would have been added for all http methods. In
   the Ruby CLI, it was enough to add it in one place.

A more elaborate solution where the check was moved into the
'config' slice was considered but rejected because I wanted
to keep the alteration as limited (and thus easy to review)
as possible.

The commit also contains some tests to verify that the config
is impossible to obtain using the web.
Merge pull request #1 from thallgren/bug/master/nodejs-security

Bug/master/nodejs security
New download path for Microkernel images
Merge branch 'master' of https://github.com/puppetlabs/Razor