(#11563) Preserve deny ACEs

Previously, puppet would warn if it encountered a deny ACE, and ignore it.
This is a problem now, because we need to be able to accurately round-trip
an ACL when modifying the owner/group.

This commit modifies the DACL parsing code to return the deny ACE in the
returned ACE.
(#11563) Return INHERIT_ONLY_ACEs

Previously, when reading a DACL, puppet excluded `INHERIT_ONLY_ACE`s which are
ACEs set on a directory that only serve to apply permissions to child
containers (dir) and objects (file). In other words, the ACE didn't affect the
permissions of the directory, and wasn't needed to determine the file mode.

However, now we need to be able to roundtrip a security descriptor, e.g. to
only change the owner, but leave other ACEs intact.

This commit modifies puppet to include inherit only aces when reading the
DACL, but continue to exclude them when determining the file mode.
(Maint) Change usages of `and` to `&&`, and `or` to `||`

The operators `and`, `or` have a lower precedence than `&&`,
`||`. This can lead to unexpected results in certain cases. While this
commit is not subject to one of those cases, the change is still made
for consistency sake.
(#11563) Cleanup tests

Cleanup spec test. Use the Everyone sid constants, remove unused
reference to INHERITED_ACE constant, and more robustly assert the
desired outcomes when "preserving aces for other users" and when
"changing the sid for all aces that were assigned to the old
owner".
(#11563) Fix issues when running as SYSTEM

Previously, the tests were failing when running as SYSTEM, because
many of the preconditions were no longer true, as a result of
puppet no longer breaking inheritance when only the owner and mode
are changed, and ensuring the SYSTEM ace grants full control,
unless explicitly specified otherwise.

This commit updates the tests to account for the new behavior.
(#11563) Implement pending tests for when permissions are insync

When permissions are insync, i.e. puppet is actively managing the
owner, group, and mode, then we ensure that an explicit SYSTEM ace has
been added. When source_permissions is set to ignore, we ensure that
an inherited SYSTEM ace has been added.
Merge pull request #2110 from nfagerlund/source_permissions_copyedit

Maint: Copyedit description of source_permissions attribute for clarity
(maint) Extract common acceptance setup script for Jenkins

We have six Jenkins jobs which currently run acceptance, and will soon
have another four for per commit tests.  There is a shell script used to
prepare each job for Rake execution of the actual test run.  This script
currently exists in every job and is slightly divergent across jobs, and
makes updating the prep for each job time consuming and error prone.  So
I'm pulling it into acceptance as a single script to handle untarring of
the artifact and bundle set up for any acceptance job.

This change also provides a means for specifying the git daemon along
with the fork so that you can install from local commits.

Finally it moves repo_proxy and add_el_extras beaker settings into the
common options.
(#11563) Output human readable security descriptor

Overrides `inspect` methods to return human readable sid and flags.
Maint: Explain the format and effect of install_options for the RPM provider
(#11563) Create an explicit ace if the old ace is inherited

Given a directory owned by Administrators and group None, and with DACL:

    NT AUTHORITY\SYSTEM:(I)(OI)(CI)               0x1f01ff
    BUILTIN\Administrators:(I)(OI)(CI)            0x1f01ff
    WIN-QP47VOHA2P4\albert:(I)(OI)(CI)            0x1f01ff

where the ACE for the owner is inherited (I). If puppet changed the owner to
Users, it would copy all of the inherited ACEs as-is. But the new owner
would not have any privileges, even though the old owner did. The same is
true for group.

This commit ensures that if we see an inherited ACE for the old owner, that
we prepend a new explicit ACE, whose type (allow or deny), flags and mask
grant/deny the same access as the inherited ACE did.

Note that not all flags are valid when setting an ACE, e.g. INHERITED_ACE is
only something you can read, not set.

As a result of this change, when puppet changes the owner from Administrators
to Users the dacl will have the following ACE prepended to the list, with
the existing inherited ACEs copied as-is:

    BUILTIN\Users:(OI)(CI)                        0x1f01ff

Note that the new ACE has the same mask as the old one, and has the object
and container inherit flags set.
Maint: Note that mount points autorequire any parent mounts
Merge pull request #2107 from justinstoller/maint/master/configurable_gem_mirror

allow configuration of Bundler source
Merge pull request #2113 from jpartlow/maint/master/extract-common-jenkins-setup

(maint) Extract common acceptance setup script for Jenkins
Merge remote-tracking branch 'joshcooper/ticket/master/11563-owner-group-mode-are-interdependent'

* joshcooper/ticket/master/11563-owner-group-mode-are-interdependent:
  (#11563) Create an explicit ace if the old ace is inherited
  (#11563) Output human readable security descriptor
  (#11563) Implement pending tests for when permissions are insync
  (#11563) Fix issues when running as SYSTEM
  (#11563) Cleanup tests
  (Maint) Change usages of `and` to `&&`, and `or` to `||`
  (#11563) Return INHERIT_ONLY_ACEs
  (#11563) Preserve deny ACEs
  (#11563) Only rewrite the DACL if the mode changes
  (#11563) Refactor DACL parsing
  (#11563) Model Windows security descriptors
  (Maint) Eliminate Windows network lookups
Merge pull request #2115 from nfagerlund/mount_autorequire

Maint: Note that mount points autorequire any parent mounts
Merge pull request #2114 from nfagerlund/rpm_install_options_description

Maint: Explain the format and effect of install_options for the RPM prov...
(packaging) Update PUPPETVERSION to 3.4.0-rc1
Merge tag '3.4.0-rc1' into stable

3.4.0-rc1

* tag '3.4.0-rc1': (465 commits)
  (packaging) Update PUPPETVERSION to 3.4.0-rc1
  Maint: Note that mount points autorequire any parent mounts
  (#11563) Create an explicit ace if the old ace is inherited
  Maint: Explain the format and effect of install_options for the RPM provider
  (#11563) Output human readable security descriptor
  (maint) Extract common acceptance setup script for Jenkins
  (#11563) Implement pending tests for when permissions are insync
  (#11563) Fix issues when running as SYSTEM
  (#11563) Cleanup tests
  (Maint) Change usages of `and` to `&&`, and `or` to `||`
  (#11563) Return INHERIT_ONLY_ACEs
  (#11563) Preserve deny ACEs
  (#11563) Only rewrite the DACL if the mode changes
  (#11563) Refactor DACL parsing
  (#11563) Model Windows security descriptors
  (Maint) Eliminate Windows network lookups
  (Maint) Refactor method names in file_spec
  (Maint) Refactor expectations for at least one inherited system ace
  (Maint) Refactor expectations when system granted full access explicitly
  (Maint) Be more explicit about when the SYSTEM ACE is overwritten
  ...
(maint) Skip enc test on lucid

Currently the lucid runs of this test are failing pretty frequently because
of difficulties getting to rubyforge.org.  This change would skip this
test on lucid.

We're already skipping this test on other platforms due to various difficulties
(read the log for this file). And activerecord is a deprecated feature, so this
test won't be around for too much longer.  Meanwhile, we have decent coverage
of this feature since it still runs against RHEL5 and newer Ubuntus.