source function library *before* client sysconfig overrides

My client's environment mandates strict umask settings:
  - 027 for init scripts
  - 077 for normal users
This causes problems when using exec resources or any add-on functions
that exec external scripts/programs.

The fix is relatively simple - run umask in /etc/sysconfig/puppet
and set a more lenient umask for puppet.
However, the /etc/sysconfig/puppet is sourced before the init
function library so any umask changes made in the former are
overridden by any in the latter.

Looking in other init scripts (including the puppetmaster init
script), it is usual for the function library to be sourced at the
start of the init script, ie. before the sysconfig override.

This change simply moves the lines that source the init function
library to the start of the init script.
(PUP-1174) enable the purging of authorized ssh keys

Purging authorized ssh keys is difficult because there is no way know
where key files may be located. Users commented that for most it should
be sufficient to clean the keys from users that puppet manages.
John Bollinger suggested a design that's based on a new parameter to the
user type. There are two ways to use it:

user { "name": purge_ssh_keys => true }

to make puppet purge from the default ~/.ssh/authorized_keys file, or

user { "name": purge_ssh_keys => [ "/etc/keyfiles/name" ] }

to specify one or more files in non-standard locations.

The implementation is similar to the file type's purging code. The user
type now has an eval_trace method that searches the specified files for keys
and adds any unmanaged keys to the catalog with ensure => absent.
(PUP-1174) amend resources type documentation

Add a reference to the new purging feature to the documentation of the
resources type description.
(PUP-1174) add tests for the purge_ssh_keys parameter of the user type
Clarified `pattern` parameter for Service type (DOCUMENT-1)
(DOCUMENT-22) Clarify matching of crontab entries

This updates the documentation to be consistent with behavior introduced in
commit da9162c.
Clarified the use of slashes around RegEx for `pattern` attribute
(PUP-1220) apply proper scoping rules to scope#to_hash

The fix for #1427 added an instance method to the scope class
for exporting all variables from the local scope. This method
apparently re-implemented the dynamic scoping rules.

When those were removed, the #to_hash method was left as was.
As a result, dynamic scoping still worked from within templates,
when using the @variable syntax in the erb code.

Fix this by using the new #enclosing_scope method so that proper
scoping rules are used instead.
(PUP-1220) make the dynamic scoping fix for #22800 flexible

As suggested by Henrik Lindberg, make the parser only behave correctly
when parser=future is configured. If working manifests rely on the
regression, the next point release won't break them. Instead, users can
test for this using the configuration setting.

The next major release should adopt the fix as standard behavior and
the legacy support should be removed. Since the variable lookups in
templates relies on the accessing of local attributes, there is no
way to issue deprecation warnings to users.
(PUP-1220) optimize template scoping fix

Following enhancements as suggested by Erik Dalen, Andy Parker et al.
* prefer Puppet[:parser] over Puppet['parser']
* cache the config value of Puppet[:parser]
* pick the future vs. legacy branch only once per template
(maint) Typo fixes: repeated words (e.g. "the the")
(maint) Revise help for puppet config subcommand

Mostly adding context about the idea of sections, inc. list of available sections.
(PUP-1749) Fix module_tool extract for non-gnu tar

This commit refactors how tar is called when the module tool extracts a
downloaded archive so that it is compatible with generic Unix tar, and
does not require GNU extensions. The commit allows the module tool to
work out of the box on Solaris 10, without requiring access to the gtar
command, and presumably this aspect of the module tool will now work
with tar on other old-style unix platforms as well.
Add tests for module_tool changes

I'm not entirely sure if I'm using #yields() correctly but this allows
me to expect that Dir.chdir is called, and still expect all the calls to
Puppet::Util::Execution.execute to be made.
(pup-1766) Remove duplicate test
(pup-1766) Add support for multiple defaultfor's

Prior to this change, it was possible to specify a defaultfor to
cover, say, multiple osfamily's e.g. with:
    defaultfor :osfamily => [:os1, :os2]
Or it was possible to specify a more complex hash, e.g. with
    defaultfor :osfamily => :os1, :operatingsystemmajorrelease => "42"

But if more specificity for just one of the operatingsystem values was
needed, defaultfor couldn't support that. This change allows for this, e.g.:
    defaultfor :osfamily => :os1  # all variants of os1
    defaultfor :osfamily => :os2, :operatingsystemmajrelease => "42"  # only release #42 of this os

To support this change Provider defaults is now an array of hashes (formerly,
it was a merge of the hashes provided by all defaultfor invocations), which requires
commensurate updates to the specificity method and the dochook.

There are also some new spec tests for representative defaultfor combinations, and
two spec tests needed to be updated with the expectation that Facter will be invoked
to assess defaultprovider specificity.
(pup-1766) Set systemd as a default provider for the service type on rhel7
(pup-1766) Add support for :feature to defaultfor

Previous to this change defaultfor had no support for a key
of :feature, however the exec/posix.rb provider assumed
there was such support.

The only reason this worked was that the specificity method
evaluated hash length independent of whether the hash matched
reality in anyway. E.g. exec/posix.rb could just as easily have
specified:
  defaultfor :foo => :nonsense
And it would have a specificity of 1 (yay).

This stops working with the changes in this pull request to
make specificity actually evaluate whether the specified hash
is match in anyway.

So, this commit adds the :feature support to defaultfor which
exec/posix.rb already assumed it had. That file was the only
use of 'defaultfor :feature' I found, but adding this support
seems like potentially useful as an enhancement.
(PUP-1041) nagios: parse empty parameter values in definitions

This is a valid nagios defintion:

define host {
	parents
	use       linux-server
}

That's because an empty parents list has distinct semantics. There may be
other variables that can take an empty value, possibly in conjunction with
object inheritance.

The naginator provider will not accept this definition, because the
nagios config parser expects a value for each and every parameter.

Fix this by adding an according rule to the grammar.

Also, the lexer must be altered, because parameters and values are lexed
differently and returned as distinct tokens. When encountering newline
while scanning for a parameter value, the lexer must give up and reset
its internal state. (Otherwise, it would not accept another parameter
name or the end of the current definition block.)
(maint) Allow arrays, bools, and numerics to be frozen