(PUP-3401) Fix type calculations of "all Patterns"

The type calculator did not correctly compute assignability for
a non parameterized Pattern. Such a Pattern is equal to "any string",
and is thus assignable from any other Pattern, Enum or String.

This was missing in the calculator and this resulted in Pattern neither
being equal to, less than, or greater than parameterized patterns.
(PUP-3334) Clear environment settings caches

Prior to this commit, environment settings were not being updated
when environment.conf was changed, even if environment timeout had
expired. This was because they were being cached in places in
Puppet.settings that were not being cleared.

Now, all the cached data for a particular environment is cleared
when the environment timeout expires.
(PUP-3334) Add test to ensure cache is cleared

In order to ensure that we don't encounter this issue again, add
a test case to environments_spec to ensure that the cache is being
properly cleared.

Additionally, fix a small bug in environment's list method where
a string should been converted to a symbol.
Merge pull request #3197 from hkenney/issue/stable/pup-3334_fix_environment_conf_not_changing_issue

(PUP-3334) Fix issue around settings not updating with environment.conf
Merge pull request #3195 from hlindberg/PUP-3401_fix-pattern-type

(PUP-3401) Fix type calculations of "all Patterns"
(PUP-3277) Use owner from puppet settings rather than beaker defaults

The beaker host['user'] default setting is root, but the actual user
setting from puppet defaults is likely to be puppet or pe-puppet.  By
using the puppet settings, we are more likely to stay in sync with how
the files are being set by packaging or managed by puppet or supporting
puppetlabs modules.  This should cut down on spurious changes to
environment owner/modes that were cropping up in some pe test runs.
(PUP-3277) Ensure agents re-enabled after disable agent test

And a step in the agent_disable_lockfile step to ensure that agents are
re-enabled. This should insulate subsequent tests from a failure partway
through agenet_disable_lockfile leaving disabled agents in its wake.
Merge branch 'issue/stable/pup-3277-envdir-perms' into stable

* issue/stable/pup-3277-envdir-perms:
  (PUP-3277) Ensure agents re-enabled after disable agent test
  (PUP-3277) Use owner from puppet settings rather than beaker defaults
(maint) Only test lookup() with future parser

The lookup function only works when the future parser is in effect. This
changes the spec tests to turn on the future parser.
(PUP-3201) Stop using :undef for parameters in 4x

The :undef symbol was still leaking all over the place internally. This
caused type inference to sometimes end up with Runtime[ruby, Symbol]. By
using nil instead of :undef, everything can be much more
straightforward. Once the code removal for puppet 4 comes into play even
more oddities around how resource parameters are handled can be
performed.
Merge pull request #3210 from zaphod42/issue/stable/pup-3201-incorrect-string-for-undef

(PUP-3201) Stop using :undef for parameters in 4x
(PUP-3467) Reject SSLv3 connections in webrick

Webrick will now reject SSLv3 connections. If an SSL client tries to
connection with SSLv3, webrick+openssl will issue an sslv3 alert
handshake failure.
(PUP-3467) Update webrick ciphersuites to match passenger

Previously, puppet's webrick server did not specify which ciphersuites
it would accept. Depending on the ruby and openssl, the default set of
ciphersuites is:

    $ ruby -ropenssl -e 'puts OpenSSL::SSL::SSLContext::DEFAULT_PARAMS[:ciphers]'
    ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW

Note that "ALL:!ADH" does not exclude AECDH, and the default param
string includes "LOW", e.g. DES-CBC-SHA.

This commit updates the webrick ciphersuites to match the value used
in passenger in commit 204b2974b. The resulting ciphersuites are:

    [["DHE-RSA-AES256-GCM-SHA384", "TLSv1/SSLv3", 256, 256],
     ["DHE-RSA-AES256-SHA256", "TLSv1/SSLv3", 256, 256],
     ["ECDHE-RSA-AES256-GCM-SHA384", "TLSv1/SSLv3", 256, 256],
     ["ECDHE-RSA-AES256-SHA384", "TLSv1/SSLv3", 256, 256],
     ["DHE-RSA-AES128-GCM-SHA256", "TLSv1/SSLv3", 128, 128],
     ["DHE-RSA-AES128-SHA256", "TLSv1/SSLv3", 128, 128],
     ["ECDHE-RSA-AES128-GCM-SHA256", "TLSv1/SSLv3", 128, 128],
     ["ECDHE-RSA-AES128-SHA256", "TLSv1/SSLv3", 128, 128],
     ["DHE-RSA-CAMELLIA256-SHA", "TLSv1/SSLv3", 256, 256],
     ["DHE-RSA-AES256-SHA", "TLSv1/SSLv3", 256, 256],
     ["ECDHE-RSA-AES256-SHA", "TLSv1/SSLv3", 256, 256],
     ["DHE-RSA-CAMELLIA128-SHA", "TLSv1/SSLv3", 128, 128],
     ["DHE-RSA-AES128-SHA", "TLSv1/SSLv3", 128, 128],
     ["ECDHE-RSA-AES128-SHA", "TLSv1/SSLv3", 128, 128],
     ["CAMELLIA256-SHA", "TLSv1/SSLv3", 256, 256],
     ["AES256-SHA", "TLSv1/SSLv3", 256, 256],
     ["CAMELLIA128-SHA", "TLSv1/SSLv3", 128, 128],
     ["AES128-SHA", "TLSv1/SSLv3", 128, 128]]
(PUP-3467) Reject SSLv3 when initiating SSL connections

Previously, when puppet initiated SSL connections, e.g. puppet agent,
puppet module, etc, it could downgrade to SSLv3.

This commit ensures puppet will not downgrade to SSLv3 by setting the
`OpenSSL::SSL::OP_NO_SSLv3` bit. However, unlike SSLv2, we cannot remove
SSLv3 ciphersuites, since they are the same ones used in TLSv1. From the
openssl ciphers man page, "The TLSv1.0 ciphers are flagged with SSLv3".

[1] https://www.openssl.org/docs/ssl/SSL_CIPHER_get_name.html
Merge pull request #3215 from joshcooper/ticket/stable/PUP-3467-reject-sslv3

(PUP-3467) Reject SSLv3
(packaging) Update PUPPETVERSION to 3.7.2