(DRAFT) kerberos baby steps

(THIS IS A DRAFT. It is not intended for formal submission. I'll work on proper,
separate, tested, pull requests, but in the meantime this gives some idea of the
basic changes required for Kerberos authentication support in puppet master.)

Allow curl --negotiate requests to return a node document. E.g.:

  $ curl --negotiate -u: -H 'Accept: pson' \
  'https://puppet:8140/production/node/myhost$@EXAMPLE.COM'
  {"document_type":"Node",
   "data":{"name":"myhost$@EXAMPLE.COM","environment":"production"}}
  $

There are two basic chages:

* lib/puppet/network/authstore.rb:

Allow creation of AuthStore::Declarations that can hold Active Directory service
accounts with $'s in them. For now I implemented this in terms of the existing
:opaque Declarations with a fix for matching names with uppercase. NOTE: There
are multiple issues in authstore.rb that will likely need to be resolved before
we come up with an acceptable patch here.

* lib/puppet/network/http/rack/rest.rb:

Pick up the principle from the REMOTE_USER environment variable. Unfortunately I
was unable to get the principle name into a header. It looks like headers may be
preferred over environemnt variables? I've tried mod_rewrite look aheads w/o
success...