source function library *before* client sysconfig overrides

My client's environment mandates strict umask settings:
  - 027 for init scripts
  - 077 for normal users
This causes problems when using exec resources or any add-on functions
that exec external scripts/programs.

The fix is relatively simple - run umask in /etc/sysconfig/puppet
and set a more lenient umask for puppet.
However, the /etc/sysconfig/puppet is sourced before the init
function library so any umask changes made in the former are
overridden by any in the latter.

Looking in other init scripts (including the puppetmaster init
script), it is usual for the function library to be sourced at the
start of the init script, ie. before the sysconfig override.

This change simply moves the lines that source the init function
library to the start of the init script.
(maint) Simplify the CA use of the autosign setting

Commit bca628dc adds proper conversion of autosign input values to
booleans, but Puppet::SSL::CertificateAuthority was still trying to
handle string values. This commit simplifies the checking logic and lets
the autosign setting handle data normalization.
(PUP-1174) enable the purging of authorized ssh keys

Purging authorized ssh keys is difficult because there is no way know
where key files may be located. Users commented that for most it should
be sufficient to clean the keys from users that puppet manages.
John Bollinger suggested a design that's based on a new parameter to the
user type. There are two ways to use it:

user { "name": purge_ssh_keys => true }

to make puppet purge from the default ~/.ssh/authorized_keys file, or

user { "name": purge_ssh_keys => [ "/etc/keyfiles/name" ] }

to specify one or more files in non-standard locations.

The implementation is similar to the file type's purging code. The user
type now has an eval_trace method that searches the specified files for keys
and adds any unmanaged keys to the catalog with ensure => absent.
(PUP-1174) amend resources type documentation

Add a reference to the new purging feature to the documentation of the
resources type description.
(PUP-1174) add tests for the purge_ssh_keys parameter of the user type
Clarified `pattern` parameter for Service type (DOCUMENT-1)
(PUP-1278) Windows Puppet Agent Service gracefully terminates after succesfully being put into a Paused state

Removed redundant return statement
Added in logic to only start the Puppet Agent if the service is in a Running or Idle state
(DOCUMENT-22) Clarify matching of crontab entries

This updates the documentation to be consistent with behavior introduced in
commit da9162c.
(pup-640) Update report schema for error events

Previously, special handling was added to synthesize a report
event even when the property application failed early. However,
when this change was made the report schema wasn't updated,
so the schema did not allow for several fields in the event
to be null (as they are for one of these synthesized events).

This change updates the report schema to reflect that certain
fields can be null. It also adds a spec test including an error
event, which requires the schema change in order to pass.
(PUP-576) Handle Ruby 2.0 OpenSSL lib error message

The error message returned by Ruby's OpenSSL library when the host name
does not match the server certificate changes between 1.8, 1.9 and 2.x.
We handle this message and re-wrap it in a more informative form, but
were failing to catch the 2.x variation.

1.8: 'hostname was not match with the server certificate'
1.9: "hostname does not match the server certificate"
2.x: "hostname \"#{hostname}\" does not match the server certificate"

(2.0 and 2.1 as of the time of this commit)

This change just alters the regex to catch all three variants.
(PUP-1529) Make squelch of parse error specific to resource_type command

Without this fix, all indirect loading of .pp logic will silently fail.
With this fix, only queries via the resource_type command have
parse errors squelched in order to allow search to continue past a
syntax error.
Merge branch 'stable'

Conflicts:
	lib/puppet/indirector/resource_type/parser.rb
(maint) Fix error message in reduce function

If you had 3 parameters this error message would print the type of the
wrong parameter.
(PUP-1529) Make squelch of parse error use context instead of global

This fixes up the earlier fix for 3.4.x where a global variable
was used to control if parse errors should be raised or not.

Now the context system is used instead of a global variable. (It is
still a boolean value since there is no other immediate use for a
strategy that either raises the error or logs the problem).
Merge pull request #2312 from dalen/future_parser_fix

Fix error message in reduce function
(PUP-576,PUP-1064) Update to activerecord 3.2.x to work around a Ruby 2.x issue

tests/store_configs/enc_provides_node_when_storeconfigs_enabled.rb fails
running under Ruby 2.0 because of a bug between activerecord 3.0 and
Ruby 2.0.  This fails with:

  'undefined method `insert_record' for <Array:0x00000003027be8>'

when Puppet::Rails::Host attempts to save with merged facts.  The root
cause is tangled up in ActiveRecord's association proxies.

ActiveRecord 3.2 has patches which allow it to work under Ruby 2.0

However making this change unearthed another Rails issue which Andrew
Parker recalled was in fact PUP-1064.  This issue tracks a
general failure in Puppet on any Ruby version working with ActiveRecord
> 3.0.10.  Fortunately there was a patch attached to PUP-1064 which
guards lookup of the activerecord id property on the
puppet/rails/resource.rb activerecord object, and this does appear to
fix the issue.
(maint) Add optional_parameter_count method to Closure

Add a method to return number of optional parameters on
Puppet::Pops::Evaluator::Closure just like Puppet::Parser::AST::Lambda
has.
(PUP-1118) Convert environment for nodes on load

The environment for a Puppet::Node instance is turned into simply the
name of the environment when the Puppet::Node is serialized. Since we
then load the Puppet::Node back in using YAML, and YAML uses the magic
of type annotations to re-create the Puppet::Node instance, the
environment that ends up being set on the Puppet::Node instance isn't
an instance of Puppet::Node::Environment, but is a String.

Since the Puppet::Node doesn't get a callback during deserialization, we
added a fixup method to the Puppet::Indirector::YAML implementation so
that the node object can be fixed up before being handed out to the big,
bad world.

The other choice was to use safe_yaml to load the file and then do the
conversion, but safe_yaml is significantly slower than just plain yaml
and we decided to avoid the performance hit.
(PUP-1278) Updating Windows service event messages.

Changing the service startup message to not include the agent
parameters.  This will now only be printed when actually doing the agent
run.

Removing the "service running" message from the loop as this prints out
repeatedly even if the service is paused.

Moving determining the path to puppet to outside the run loop.
Merge branch 'pr/2301'

* pr/2301:
  (PUP-1278) Updating Windows service event messages.
  (PUP-1278) Windows Puppet Agent Service gracefully terminates after succesfully being put into a Paused state

This closes GH-2301.