(maint) Test a different cert for extensions

The FOSS ssl/certificate_extensions test expects to be able to clear out
the ssl store and start again.  This is not feasible in PE; the solution
is to run the test against a differente certname.  Also leaving temp
dirs in place, because it makes it much easier to review the files that
were used when troubleshooting test failure.
Merge branch 'maint/stable/ssl-cert-ext-acceptance-fix-for-pe' into stable

* maint/stable/ssl-cert-ext-acceptance-fix-for-pe:
  (maint) Test a different cert for extensions
Merge remote-tracking branch 'upstream/stable'

* upstream/stable:
  (maint) Test a different cert for extensions
(packaging) Update PUPPETVERSION to 3.6.1
Merge branch 'stable'

* stable:
  (packaging) Update PUPPETVERSION to 3.6.1
(PUP-2642) Make default in selector be out of band, raise error nomatch

This makes the selector expression in the future evaluator have
the same semantics as the 3.6.1 current evaluator. The future evauator
did not process default out of band, and did not raise an error when
there was no match.

This fixes both problems.
(PUP-836) FFI Puppet::Util::Windows::User

 - LogonUserW, LoadUserProfile, UnloadUserProfile and PROFILEINFO
   have been converted from manually packing params with Win32API.new to
   automatically managed with FFI definitions.
 - Use MemoryPointer where appropriate.
 - Note that wide character LogonUserW is used rather than platform
   varying LogonUser as FFI is unable to use that.  The pointer
   widths of PROFILEINFO vary depending on platform, which is handled
   by using :pointer.  With LogonUserW the string pointed to is always
   wide character, which is properly handled by using wide_string.
 - Add FFI::MemoryPointer helper read_handle
 - Add FFI::MemoryPointer.from_wide_string and corresponding tests that
   ensure that a properly terminated UTF-16LE string is passed in
 - Add FFI::MemoryPointer#read_wide_string that reads a wide string buffer
   into a Ruby string with Encoding.default_external and corresponding tests
 - Add additional tests around User methods that make native Win32 API calls
   that will intentionally fail
 - Fix wide_string helper to return nil when given nil so that can be passed
   directly to Win32 as a null pointer
(PUP-836) FFI Puppet::Util::Windows::User

 - Remove dependence on Win32 API calls defined in the win32-security
   gem, including CreateWellKnownSid, IsValidSid, CheckTokenMembership
 - These calls have all been FFI'd accordingly
 - Add FFI::MemoryPointer helper read_bool
(PUP-836) Remove Win32::Security.elevated_security

 - Refactor Puppet::Util::Windows::Process to implement new method
   elevated_security? that was in win32-security gem
 - Refactor get_token_information to return an FFI::MemoryPointer buffer
   instead of a parsed structure, since GetTokenInformation is a generic
   call that can return many structure types, including TOKEN_ELEVATION.
 - Remove any reliance on win32-security gem from user.rb
 - Adjust tests accordingly
Merge pull request #2675 from Iristyle/ticket/master/PUP-836-FFI-Windows-User

(PUP-836) FFI Puppet::Util::Windows::User
(PUP-2544) Util::ADSI -> Util::Windows::ADSI

 - Move Windows ADSI code out of puppet/util and into
   puppet/util/windows
 - Update namespace from Puppet::Util::ADSI to
   Puppet::Util::Windows::ADSI
 - Add module / class definitions for ADSI to util/windows.rb
   to prevent tests from blowing up on non-Windows
 - Moving Puppet.features.microsoft_windows? checks to top of
   user and group provider tests for ADSI
 - Update all dependent code, remove unnecessary references
(PUP-2554) FFI Puppet::Util::ADSI

 - Convert ADSI GetComputerName to FFI
 - Add missing error handling for GetComputerName Win32 function
 - Add test that verifies GetComputerName returns a non-empty string
 - Add FFI MemoryPointer aliases for dwords

Conflicts:
  spec/unit/util/windows/adsi_spec.rb
Merge branch 'pr/2677'

* pr/2677:
  (PUP-2554) FFI Puppet::Util::ADSI
  (PUP-2544) Util::ADSI -> Util::Windows::ADSI

Closes GH-2677
Merge pull request #2687 from hlindberg/PUP-2642_selector-default-out-of-band

(PUP-2642) Make default in selector be out of band, raise error nomatch