(fix) Order independent ingress insync detection

 - Previously, it was possible to trivially generate spurious change
   notifications when the specified order of ingress rules inside a
   manifest did not match the order returned by AWS.  AWS always
   returns an ordered set of ip_permissions, first by protocol, then by
   port.  Since the conversion to group authorizations is lossy,
   segregate and individually sort those rules by group name.
 - Verify with an additional acceptance test that orders ingress rules
   within a manifest differently than what AWS returns, which would have
   previously caused such change notifications.
 - To support scanning Puppet apply output, it was necessary to change
   from system() to Open3.popen2e, and PuppetManifest.apply was updated
   to return a hash with the output lines and exit_status rather than
   simply returning a true / false success value.  Several callsites
   were updated accordingly.