build with latest package updates

in particular:

* glibc CVE-2014-5119
* glibc CVE-2014-0475
* puppetdb 2.2
improve oval vulnerability scan

* use git submodule for DRYer approach to include oval scan script

* scan puppet agent, puppet master, puppetdb, and puppetboard

* move scans to wercker as separate build steps so the scans
  report individually
ignore .git dirs to reduce size of uploaded context