(#23183) Use FFI to manage pointers in RootCerts module

Previously, we made assumptions about the layout of the CERT_CONTEXT
structure, specifically that PCERT_INFO (pointer to CERT_CONTEXT) was an
unsigned 32-bit integer ('L'), and magically accessed the size of the
returned structure as arr[2]. We were also memcpy 40-bytes which was
larger than the size of the CERT_CONTEXT structure in both x86 and x64 and
was the cause of infrequent segmentation faults.

This commit uses FFI to define the layout of the CERT_CONTEXT structure, uses
named fields, e.g. [:cbCertEncoded], to access offsets within the structure,
and uses the FFI::Pointer#null? method to check for NULL pointer.

Note that we use FFI::Pointer and not MemoryPointer, because the
CertEnumCertificatesInStore function is responsible for freeing the
previous CERT_CONTEXT pointer, not us.

Also in the motto of "don't stub what you don't own" it exercises the Win32
APIs to make the tests more meaningful.
Merge pull request #2079 from joshcooper/ticket/stable/23183-ffi-rootcerts

(#23183) Use FFI to manage pointers in RootCerts module
Merge branch 'stable'
(#7244) Consolidate autosign setting

Previous implementation split out a new autosign_command setting for the
custom policy executable, which required a confusing autosign=false
setting.

This commit removes the autosign_command setting and instead uses the
autosign setting for all modes (true/false, autosign.conf or custom
policy executable).  Internally we refactor to distinguish between
autosign.conf or an executable by the executable bit.

We are removing the mode of the autosign setting, because it was
stripping all executables of their executable bit.  This only removes
the guarantee that group and other do not have write permissions.
However, these are the default permissions for a regular file on most
systems, so nothing should be lost.
(Maint) Introduce partial implementation of an In-Memory file

Quite often in tests we want to work with a "file", but not actually
deal with the file system. We usually do that by mocking out all sorts
of things on File and FileUtils and Dir and various other places. Now
that we have Puppet::FileSystem::File (and maybe at some point in the
future we'll have Puppet::FileSystem::Store to represent the actual
storage system, what we normally call the filesystem itself) we can
create different kinds of files.

This adds Puppet::FileSystem::MemoryFile, which, so far, only partially
implements the methods on Puppet::FileSystem::File and addes 3 methods
to Puppet::FileSystem::File to allow us to easily create a view onto the
filesystem: overlay, remember, forget.
(#7244) Fix up tests after refactors of the Autosign system

The refactoring of the Autosign system changed its interaction with the
filesyste. This fixes up the tests to work with the new interactions and
hopefully be more robust to future changes.
(#19514)(PP-773) Rename hashed_node_data and cliencert for $trusted

This renames hashed_node_data to trusted_node_data, and
the element 'clientcert' to 'certname'.

This also fixes the issues regarding immutability reported in PP-773.
It is now not possible to alter the trusted data. (A freeze was missing
when the data was created). As extra precaution, the data is frozen when
set as trusted data in the node.

There is now also a warning if an attempt is made to modify the trusted
data by manipulating a node.
Merge pull request #2083 from zaphod42/jpartlow-feature/7244/refactor-autosign-setting

(#7244) Consolidate autosign setting
(#7243) Add dns_alt_names with hostname to autosign test

Lack of hostname as a dns_alt_name was producing master certs which
could not be looked up by bare hostname (as used by Beaker) in the
Jenkins environment.
Merge branch 'feature/7243/fix-autosign-command-acceptance-subjectaltnames'

* feature/7243/fix-autosign-command-acceptance-subjectaltnames:
  (#7243) Add dns_alt_names with hostname to autosign test
(#19514) Correct error message matching for Ruby 1.8.7

In Ruby 1.8.7, the error message for an attempt of mutating
a frozen hash refers to 'hash' using lower case whereas later versions
use capital 'H'. This caused two tests to fail (twice).
Define Puppet cert attribute OIDs

This commit defines an initial set of OIDs for private use within Puppet. The
defined OIDs are focused toward identifying node information that is
embedded in a node certificate.
Merge pull request #2085 from adrienthebo/feature/puppet-custom-oids

Define Puppet cert attribute OIDs
Merge pull request #2084 from hlindberg/issues/issue-19514

(#19514)(PP-773) Rename hashed_node_data and cliencert for $trusted
(Maint) Add memory terminii for CR and Key

These are sometimes useful in tests when we don't want to deal with
saving the certificates to disk, but will want to allow them to be saved
somewhere.
(#23116) Provide pluggable SSL verification

This provides the ability to create a verifier for SSL connections
opened with puppet's Puppet::Network::HTTP::Connection. The verifier is
provided the Net::HTTP connection and it just needs to configure it for
the correct verification mode.

The new functionality can be used when puppet's standard SSL
verification rules are not suited to the needs of the caller. The
impetus for this was a requirement that a connection be able to be made,
the certificates checked, but the subject and alt name checks skipped.
Rather than put that directly into puppet, this allows a new validator
to be written that performs those checks.
(#23200) Add method for checking if one OID contains another
(#23200) allow certificate factory to add custom exts
(#23200) Whitelist puppet extension requests
Merge pull request #2088 from adrienthebo/feature/ca-extreq-whitelist

feature/23200 Copy whitelisted extensions from CSRs to certs