Remove ensure property

I've refactored the acl type to remove the ```ensure``` property, since it doesn't make sense. The ```action``` parameter has been added to replace the functionality previously in the ```ensure``` property:

* ```set``` sets the specified ACLs without removing any existing non-conflicting ACLs from the path specified
* ```exact``` sets the ACLs on the path so they match the specified ACLs exactly (this is destructive, and probably what you want)
* ```unset``` removes the specified ACLs when it makes sense to do so (it will not remove mode bits)
* ```purge``` removes all ACLs from a path

The ```clobber``` parameter from my previous pull request is replaced by ```action => exact```

There are a lot of bugfixes and refactoring. Unfortunately this change may break existing ```acl``` resources, but simply removing the ```ensure``` property from your puppet code should get it to do what you want.