(PUP-2833) Make all types inherit PAnyType

Some types inherited PAbstractType (to indicate they where not
concrete). This just causes confusion when using the Ruby API
to check if a Type is PAnyType.

This makes all types inherit from PAnyType (which is the only
type inheriting from PAbstractType).
(PUP-2794) Change Callable to mean "can be called with"

It is more meaningful to check that a Callable can be called with
certain types (exact or more generic) than to check the reverse.

This alters the meaning of Callable assignability so that a more generic
Callable is accepted. While this seems counterintuitive from the
perspective of the type system, it is the constraint that is expected as
the constraint being expressed means "Must be callable with arguments of
these types", and a more generic callable is just that.

The current implementation got that wrong, and will actually accept
callables that can in fact not be called.

This also alters the assert_type function that declared that it would
call a given block with Any, Any, when in fact it will call with
Type, Type.

Note, that a function that after this delares that it calls
Callable[Any] will enforce that the given callable is Any. If the intent
is to accept any callable, the type should be given as just Callable.
(PUP-2794) Add an (internal) type called Unit and use in Callable

This adds a type named Unit, that is an "undef of sort" in that
it is assignable to anything, and anything can be assigned to it.

This type is not exposed in the Puppet Language, and it is only
used in Callables to describe that there is no type requirement on
a parameter. (For cases where reflection of a given lambda is
performed etc. or where the error raised when calling a block
is an acceptable solution).
(PUP-2794) Add support for Optional and Variant as Callable

This adds support for a callable block to be specified using
Optional or Variant, as long as any actual type is a Callable.

I.e. in the Function API, it is possible to write:

  required_block_param 'Variant[Callable[1,1], Callable[2,2]]', :block

If the function will invoke the block with either exactly one or
exactly two parameters (and when no type is specified, the type is the
internal Unit (don't care).
(PUP-2794) Change function each to dispatch based on block arity

This changes the implementation of the each function to use different
dispatchers depending on the arity of the given block. This means that
the included module for asserted_serving_size is no longer needed.
(PUP-2794) Change function filter to use dispatch for block arity

This changes the function filter to use the dispatchers instead
of having a special arity check.
(PUP-2794) Change function filter to use dispatch for block arity

This changes the function filter to use the dispatchers instead
of having a special arity check.
(PUP-2794) Change function reduce to use dispatchers for block arity

This changes the reduce function to use the dispatchers to check
the block arity.
(PUP-2794) Remove dependency on iterative common module from slice func
(PUP-2794) Modify the shared spec for iterative functions

This updates the shared tests for iterative functions to also
be capable of handling reduce. This also adds missing tests
that were part of one of the individual tests earlier.

The test for reduce now also invokes the shared behavior for argument
checking.
(PUP-2794) Cleanup dead code and fix spacing in tests
(PUP-2794) Remove Util::Functions::IterativeSupport

This removes the now unused Puppet::Util::Functions::IterativeSupport
as it is no longer being used. The smaller check is now part of each
function, and the block arity checking is done declaratively using
an apropriate Callable type for the functions' block_type.
(PUP-2794) Fix problem with check for >0 params

There was a problem with the check for empty range, as the size
of a range Integer[0,0] is not 0, but 1 (there is a 0 in the range).

Also adds test to check that type parser produces a Callable with
a Unit type when the range so requires.
(PUP-2794) Fix failing test after correction of has types > 0 check
(maint) Move the interative functions shared behavior to common dir

This commit moves the shared behavior for iterative functions to
shared_behaviours/iterative_functions.
(PUP-2177) Change Crypto Spec in accordance to bettercrypto.org

We provide an Apache vhost configuration for users that want to run a
Puppet master using Apache and Passenger. The configuration was added in
d85d73c (five years ago, roughly) and set the SSLProtocol and
SSLCipherSuite directives using the assumptions about cryptography at
the time. As part of PUP-2582 commit 05af20b70 updated the SSL cipher
suite and protocol settings to remove some of the most vulnerable
ciphers, but still contained some relaxed settings to ensure
compatibility with as many platforms as possible.

-- Summary

This commit updates the SSLProtocol and SSLCipherSuite directives to
ensure we only use secure ciphers while continuing to function on all
supported platforms. The most notable difference is that this change
switches the cipher selection from a blacklist where all ciphers are
added and then selectively removed, to a whitelist where only known safe
ciphers are allowed. The cipher suite has been selected using the
guidelines laid out by the Applied Crypto Hardening paper[0].

-- Overall cipher selection

This cipher suite was chosen by selecting for the following criteria:

  * TLS 1.0, 1.1, 1.2
  * Perfect forward secrecy/ephemeral Diffie Hellman where possible
  * Preferring strong MACs (SHA-2) where possible
  * GCM as the authenticated encryption scheme where possible
  * Always falling back to reasonably acceptable schemes for maximum
    platform compatibility

The resulting cipher suite has the following implications:

TLSv1.2 is preferred over TLSv1.0, but is still provides reasonable
ciphers with TLSv1.0.

-- Key exchange

Ephemeral Diffie Hellman and Ephemeral Elliptic Curve Diffie Hellman are
used for key exchange. EDH is preferred over EECDH due to ongoing
concerns with potential weaknesses in elliptic curve cryptography, but
EECDH is still included due to the performance benefits of EECDH over
EDH.[1] Non-ephemeral Diffie Hellman is not used to ensure perfect
forward secrecy. If EDH or EECDH are not available, key exchange will be
done using RSA for compatibility with legacy SSL libraries.

-- Authentication

RSA is used for authentication as it works in most of today's setups and
modern implementations are resistant to attack for the foreseeable future.

-- Encryption

AES256 and CAMELLIA256 count as very strong ciphers at the moment, but
if these algorithms are not available then AES128 or CAMELLIA128 will be
used as fallbacks since they are still reasonably strong. CAMELLIA is
preferred over AES due to the decision by NSS to prefer CAMELLIA, with
the following rationale:

    National ciphers such as Camellia are listed before international ciphers
    such as AES and RC4 to allow servers that prefer Camellia to be able to
    negotiate Camellia without having to disable AES and RC4, which are needed
    for interoperability with clients that don't yet implement Camellia.[2]

-- Message Authentication (MAC)

Message authentication prefers AEAD with GCM, and then falls back to
SHA256. If ECDHE is used SHA384 will be used when available. If no
better option is available SHA1 will be used.

-- Fallback

When no better cipher is available, CAMELLIA128-SHA and then AES128-SHA
(with RSA for authentication) will be used, for cases such as OpenSSL
0.9.8 which does not provide support for ECC and TLSv1.1 or above.

-- Blacklisted algorithms

On top of the algorithms blacklisted in 05af20b7, ECDSA has been
disabled due to outstanding concerns about weaknesses to cache timing
attacks.[3]

[0] "Applied Crypto Hardening": https://bettercrypto.org/static/applied-crypto-hardening.pdf
[1] "A Note on Elliptic Curve Cryptography" "Applied Crypto Hardening section 3.7"
[2] "Document the policy for the order of cipher suites in SSL_ImplementedCiphers.": https://bugzilla.mozilla.org/show_bug.cgi?id=430875
[3] "How to design an elliptic-curve signature system" http://blog.cr.yp.to/20140323-ecdsa.html

Thanks to Aaron Zauner <azet@azet.org> and bettercrypto.org for
generating and submitting the updated cipher suite.

Commit message amended by Adrien Thebo <adrien@puppetlabs.com>
(PUP-500) Add additional tests cases

Test cases added that test that the current implementation does
not regress from its current behavior.

Regular resources are collected. Collection with override can be
done multiple times. Changing and amedning values work for 
regular resources as well as virtual.
(PUP-2711) Make manifest-directory load recursively

This changes the loaded of a manifest reference that is a directory
to include all .pp recursively in this directory. The content is
sorted so that all content of directory b comes before file c in its
parent directory (rule applied recursively).
(PUP-2711) Make recursive manifest parsing conditional to future parser

This makes the ability to load all .pp files under a manifest dir
recursively conditional to parser == future. (It will become the
standard in Puppet 4.0). This is done to avoid slurping in lots of files
in case users kept other files around in a subdirectory in the belief
that they would not be loaded. Thus making it harder to upgrade.

This also adds a test that runs for future parser.
(PUP-2711) Remove '*' without effect.