(SERVER-61) improvements to the ExecutionStub

* The execution stub now returns an instance of
  Puppet::Util::Execution::ProcessOutput, as per the contract of
  Puppet::Util::Execution.execute.

* Add basic spec/unit tests

* In java, close the reader used to read the process's STDOUT.

* In ruby, close the file handles passed-in for STDIN, STDOUT, and
  STDERR; we're not using these (this is implemented in java instead),
  but Puppet::Util::Execution.execute does not close them when an
  execution stub is installed.
(MAINT) Minor presuite cleanup.

* Temporary file should use 'puppetserver' instead of 'puppetdb' in its name.
* Restructure code so it's a little easier to read.

Signed-off-by: Wayne <wayne@puppetlabs.com>
(PUP-3459) Reports dierctory created with wrong owner.

This is a workaround for a more general problem with the puppety approach to
creating application-level resources--creation of directories whose paths are
known in advance is an installation task, not a runtime task.

Signed-off-by: Wayne <wayne@puppetlabs.com>
Merge pull request #222 from waynr/maint

(PUP-3459) Pre-suite puppet bug workaround to avoid permissions errors during acceptance test.
(SERVER-61) more execution stub improvments

* Create 'ExecutionStubResult' class.
* Add a comment with link to a JIRA ticket.
(SERVER-69) Upgrade to tk-jetty9 v0.9.0
Merge pull request #226 from cprice404/maint/master/SERVER-69-upgrade-to-jetty9-0.9.0

(SERVER-69) Upgrade to tk-jetty9 v0.9.0
(SERVER-38) Store JRuby scripting containers in pool queue

This commit stores JRuby `ScriptingContainer` objects created during
JRubyPuppet pool initialization into a hash along with their associated
`JRubyPuppet` object and puts the result into the pool queue in the
service context.  The consumers of pool instances were updated to borrow
the `JRubyPuppet` object from the new hash instead of just being able to
access the `JRubyPuppet` object directly.

In the previous commit, the `ScriptingContainer` objects were not stored
in the service context and would fall out of scope when the
`create-jruby-instance` function returned.  The container objects could
then be garbage collected later on.  During garbage collection, the
terminate logic on the container would clean up -- decrement the ref
count for -- any open `ChannelDescriptor`s.  If the ref count for the
`ChannelDescriptor` had been bumped up because a file had been opened
during a JRubyPuppet request and the associated container was
terminated while the file was still open, the call that the JRubyPuppet
request would make to close the file handle would result in JRuby
throwing a `BadFileDescriptor` exception -- an assert fired because an
attempt was being made to decrement the ref count on the descriptor
below 0.  By always holding a reference to the `ScriptingContainer`s,
the containers will not be garbage collected and, therefore, the race
condition around closing descriptors would be eliminated.
(SERVER-76) Update puppet dependency

Update puppet dependency to be >= 3.7.1, rather than tying it
directly to 3.7.1.
Merge pull request #229 from fpringvaldsen/SERVER-76-puppet-dependency

(SERVER-76) Update puppet dependency
(SERVER-61) ExecutionStub: consume STDERR/STDOUT

Add a ProcessWrapper class for use by the ExecutionStub, which ensures
that the child process used to execute the command safely gets its STDOUT and
STDERR consumed by the parent process.  If this is not done, deadlock
can occur, if the child process is blocked on writing to either STDOUT
or STDERR, and the parent process is waiting on the child process to
terminate.
(SERVER-77) Enable/disabled cert status access control

This commit adds a new ca.conf setting to toggle on/off
access control to the certificate_status(es) endpoints.
The setting is optional, but defaults to true. When
false, the client-whitelist is ignored and plaintext
access is allowed.
Merge pull request #231 from nwolfe/svr77-disable-cert-status-auth

(SERVER-77) Enable/disabled cert status access control
(SERVER-39) Allow a certificate to be passed into a request via X header

This commit adds the ability for a certificate to be supplied in a web
request as the payload of a custom HTTP header, X-Client-Cert.  The
header will only be parsed for a value if the `allow-header-cert-info`
master setting is set to true.  When the certificate is retrieved, it
will be supplied as the client certificate to the Ruby request handler
stack, as a direct replacement for a certificate object that would be
typically be provided over SSL.
(SERVER-39) Addressed PR feedback

This commit addresses initial feedback in the PR, including:

  * Use `with_open` to ensure `StringReader` for decoded cert is closed
    when finished

  * Added missing value to comparison in bad request test
(SERVER-39) Addressed more PR feedback

This commit addresses additional feedback from the PR review, including:

* Using namespace for slingshot type
* Replacing use of `thrown-with-slingshot?` with `thrown+?` and put test
  assertions inline for easier identification of the point of failure
(SERVER-39) Addressed more PR feedback

This commit includes the following changes:

1) If the `allow-header-cert-info` setting is true, only the client
   headers will be processed for client cert and DN values.  The previous
   commit would have allowed these values to be set from an SSL-provided
   certificate if one were available on the request and not superceded by
   the client headers.

2) If more than one certificate is present in the `X-Client-Cert` value
   and `allow-header-cert-info` is true, a 400 Bad Request error will be
   thrown.  The previous commit would have allowed the first certificate
   from the chain to automatically be selected and used as the end client
   certificate for the request.
Merge pull request #233 from camlow325/feature/stable/SERVER-39-allow-certificate-via-x-header

(SERVER-39) Allow a certificate to be passed into a request via X header
(SERVER-48) update version to 0.3.0 for release
(SERVER-51) Update changelog for 0.3.0 release