(DRAFT) kerberos baby steps

(THIS IS A DRAFT. It is not intended for formal submission. I'll work on proper,
separate, tested, pull requests, but in the meantime this gives some idea of the
basic changes required for Kerberos authentication support in puppet master.)

Allow curl --negotiate requests to return a node document. E.g.:

  $ curl --negotiate -u: -H 'Accept: pson' \
  'https://puppet:8140/production/node/myhost$@EXAMPLE.COM'
  {"document_type":"Node",
   "data":{"name":"myhost$@EXAMPLE.COM","environment":"production"}}
  $

There are two basic chages:

* lib/puppet/network/authstore.rb:

Allow creation of AuthStore::Declarations that can hold Active Directory service
accounts with $'s in them. For now I implemented this in terms of the existing
:opaque Declarations with a fix for matching names with uppercase. NOTE: There
are multiple issues in authstore that will likely need to be resolved before we
come up with an acceptable patch here.

* lib/puppet/network/http/rack/rest.rb:

Pick up the principle from the REMOTE_USER environment variable. Unfortunately
I was unable to get the principle name into a header, which may be preferred
over and environemnt variable? I've tried mod_rewrite look aheads w/o
success...