Create a packages namespace for role package dependencies

Puppet's insipid insistance on treating repeated package declarations as errors
makes authoring roles more difficult than it should be. For each package
dependency, the role author must carefully check that no other role exists that
declares the package. If there is one, s/he must resort to Puppet trickery to
make the roles interoperable.

I don't think Puppet trickery is avoidable, but if that's the case it should be
standardized and documented. This is what this patch is about. This patch adds
a 'packages.pp' manifest to puppet/manifests/. The file contains a set of class
definitions. Each class contains a single, unparameterized package resource of
the same name as the class itself. Hyphens in package names are translated to
underscores in class names, but otherwise the names match exactly. The reason
for wrapping each package resource with a class definition is that classes may
be included multiple times whereas a package resource may only be specified
once.

From now on, roles must never declare package resources. All package resource
declarations must be in packages.pp or in modules. Package resources in
packages.pp must not be parametrized and package classes may not contain any
resources other than the eponymous package resource. Anything that doesn't fit
these constraints should get its own role.

Bug: 53222

Change-Id: I1cd47c381151232471f95266cfb428889be09d1e