Fix cmd injection in SupportController#logs

Pass arguments to system separately, to prevent shell expansion.

False positive - system() arg comes from a safe location.
Fix cmd injection in SupportController#get_cli

Pass arguments to system separately, to prevent shell
expansion.

This is probably a false positive, but at least on one occasion [1], a web
server was overwriting the SERVER_ADDR with a user supplied header, so this
prevents such bugs from affecting us.

[1] https://thin.lighthouseapp.com/projects/7212/tickets/112-thin-shouldnt-set-server_addr-with-the-value-of-x-forwarded-for
Fix cmd injection in NodeObject#bmc_cmd

Pass arguments to system separately, to prevent shell
expansion.

Whenever a node user would be named '|| rm -rf /;', obvious thing would happen.
Not sure if this is exploitable from outside, though.
Fix command injections in service object

Pass arguments to system separately, to prevent shell
expansion.

This is a false positive, all arguments come from our code.
Fix cmd injection in SupportController#export_chef

Pass arguments to system separately, to prevent shell
expansion.

This is a false positive, input comes from our code.
Fix cmd injection in NodeObject#bmc_cmd

Pass arguments to system separately, to prevent shell
expansion.

Giving a node a special name could lead to cmd execution here.
Not sure if this is exploitable from outside, though.
Replace Marshal dump+load w/ deep clone method, refactor calls

Marshal can unserialize specially crafted strings to a class, on which the user
might attempt to call arbitrary methods.

This should be a false positive, as we call only methods defined by us on the
cloned object and the unserialized value itself is probably not user supplied.

Anyway, use a deep_copy method that won't contain the special unserializing
magic.
Add Open3.popen3 wrapper that replaces ` and %x

%x() and ` allows shell expansion, similarly to system(cmd).

The alternative is to use popen3 and return its output.
Use the Cmd wrapper instead of backticks and %x

Cmd wrapper does not suffer from shell expansion.

As long as external users cannot supply their own specially crafted docs, the
first occurence is a false positive.

The second is in unreachable code.
Move const_get calls to a protected method in a helper, include where needed

const_get can be dangerous when used w/ kernel and a user param specifying a
method.

This is not the case here, move all occurences to a special helper,
so the code can be more easily refactored to a (safe) factory method.
Fix remote exec in NodeObject#alias=

This is a false positive, all input comes from our code.
Fix remote command execution in ServiceObject#apply_role

Another false positive.
Fix unescaped URL param being passed into the template