(#22535) Use a response header for version

The initial fix for #22535 used a new field in the status endpoint hash
to return the puppet master version.  The status endpoint has been
enabled in authconfig.rb since 2.6, so this seemed safe.  However,
acceptance tests are based on conf/auth.conf (as is the default PE
auth.conf), which was never updated to enable the status endpoint.
So the status endpoint is not a good choice for returning the puppet
master's version.

This patch adds a response header containing the puppet version and
uses that to control yaml backward compatibility mode.

This also required updating spec tests, including several that have
a simple mock up of the http response object.