(PUP-1426) Disallow Puppet SSL autodefenestration

The puppet cert command supports an '--all' and a '--signed' flag so
that operations take take a list of values can operate on matching
values without having to enumerate them. However these options would
also apply to the 'clean' and 'revoke' actions. This means that
accidentally running `puppet cert clean --all` promptly and without
warning revokes and then removes all certificates. In other parlance,
this kills the CA.

Because this command is extremely dangerous and doesn't have any sane
use cases that we could determine, this commit disallows using
'--signed' or '--all' with the 'clean' or 'revoke' options. If this
functionality is needed we can add a '--force' flag to allow this
operation later.
(PUP-3605) Add new OpenBSD user provider

This new provider is now needed because of the '-S' flag to usermod as well as
the different way expiry is set.
(PUP-1270) downgrade IPS packages in-place instead of uninstall-reinstall

Only use 'pkg install' when the package is absent, and 'pkg update'
otherwise. pkg(1) can do both downgrades and upgrades this way.
(PUP-1270) Use full IPS package version matching

Originally, the pkg provider would only consider IPS versions partially,
eg. '1.0-0.151006', due to not calling pkg(1) with -v. This version
string is missing the "build version" and "timestamp" (documented in
pkg(5)). This causes several issues:

- ensure => latest does nothing when the updated package only has a
  changed timestamp
- ensure => '1.0,5.11-0.151006:20140220T084443Z' is always applied,
  because it's not string equal to what puppet thinks is the installed
version ('1.0-0.151006'); this causes pkg(1) to exit with status 4,
which makes puppet throw an error
- ensure => '1.0-0.151006' sort of works; on the first run, it installs
  the latest available matching version (due to pkg(1) working that
  way), and on subsequent runs does nothing. This can lead to subtle bugs
  where systems provisioned later do not necessarily have the same version
  of a package installed (ie. if a newer-timestamped one was released in
  the meantime).

This commit implements a provider-specific insync? for the pkg type.
Unfortunately it's not possible to fix this issue without allowing
less-than-explicit version numbers in ensure (because that's the
original behavior) without breaking backward compatibility. We try to
match the default behavior of pkg(1) when encountering
less-than-explicit versions in ensure, and throw warnings for such
implicit version matches.
(PUP-3718) Make defined function handle qualified variable names

The defined function can answer if a variable is defined. There
were however no tests for qualified variable names. The implementation,
when given a qualified name simply tried to lookup the complete name
in its own scope which naturally failed.

This commit adds logic to check if a variable is qualified in the
Scope#exist? method, and then mimics the behavior of a variable
lookup by splitting the name, then looking up the class and its scope
and finally delegating the exist? call to that scope.

This is made somewhat complicated when testing due to the fact how
scopes are wired (to find other names scopes). The test that checks for
the existence of a top scope variable now sets this up as if the main
class (called '') had been evaluated.
(PUP-2904) Make functions 4 API require symbol param names

There was a mix of String and Symbol in our code. This enforces
that parameter names must be Symbol. Thus it is up to the caller to
use the right thing as this is better than performing an intern
(performance and may intern something big/bad).
(PUP-3680) Remove confusing convenience Hash[value-type]

In an attempt to be helpful, the type system offers a convenience
that if a Hash type is specified with one key, then this is taken
as being the type of the value (and the key type defaults to
Scalar).

In practice this proved to be confusing as it raises the question
about if it is the key type or the value type that is being
specified. Some users thought it was they key type, as that is
what they wanted control over, others thought it was the value type.

From a consistency standpoint (a Hash is a Collection), it could
be viewed as being a collection of Tuple[Key, Value], but implementing
that is not very helpful (it is just more to type). The best solution is
therefore to simply remove the convenience and require both Key and
Value type as a minimum. (This also removes the confusion over the error
if wanting to specify Hash[Value, 2,5] (which fails because 2 is not a
type). Now users have to specify the full type: Hash[Key, Value, 2, 5]
if they want to add min and max entries.
(PUP-1270) don't fail implicit version install when is == :absent
(PUP-1270) add tests for implicit version ensures
(PUP=2563) Remove 1.8.7 explanatory comments from acceptance tests
(PUP-2563) Remove fix for pup-2478, which was 1.8-specific
(PUP-2563) Update quickstart.md for which rubies puppet supports
(PUP-2563) Remove 1.8 dependencies from Gemfile
(PUP-2563) Remove 1.8.7 support
(PUP-2563) Remove 1.8.7 monkey patches

This leaves some monkey patches related to 1.8.7 but tied to other
code removals (rdoc, activerecord). It also leaves in a couple that
I wasn't sure about, so there may be more monkey patches to prune.
(PUP-2563) Update unicode.md to reflect a post-1.8 world
(PUP-2563) Remove workarounds for 1.8 behavior for hash.selecdt
(PUP-2563) Revert "(PUP-3682) Disable HTTP keepalive in webrick on 1.8.7"

This was 1.8-specific fix so can be reverted.

This reverts commit 8461eb4870c4e3dbe823ede29134abad207b7249.
(PUP-2563) Remove incorrect comment about select!
(PUP-2563) Remove workaround for 1.8.7 not having ordered hashes