(#14615) Don't run dangerous init scripts on Debian

The init service provider has an exclude list of init scripts which
shouldn't be executed because they don't actually have a status
subcommand. However, this list was missing a couple of scripts on Debian
which also shouldn't be run: rcS and module-init-tools.

This also adds an acceptance test verifying that `puppet resource
service` doesn't change the state of the system. It does this by running
it twice and making sure the output is the same. In certain cases, this
may actually fail to identify a problem (if the init script which causes
trouble runs first, for instance), so we also verify that a known
service (ssh) is unaffected by running the command.
Merge branch 'nicklewis-rcS-is-a-jerk' into stable

* nicklewis-rcS-is-a-jerk:
  (#14615) Don't run dangerous init scripts on Debian

closes #1617
Merge branch 'stable'

* stable:
  (#14615) Don't run dangerous init scripts on Debian