(PUP-3605) Add new OpenBSD user provider

This new provider is now needed because of the '-S' flag to usermod as well as
the different way expiry is set.
(PUP-1270) downgrade IPS packages in-place instead of uninstall-reinstall

Only use 'pkg install' when the package is absent, and 'pkg update'
otherwise. pkg(1) can do both downgrades and upgrades this way.
(PUP-1270) Use full IPS package version matching

Originally, the pkg provider would only consider IPS versions partially,
eg. '1.0-0.151006', due to not calling pkg(1) with -v. This version
string is missing the "build version" and "timestamp" (documented in
pkg(5)). This causes several issues:

- ensure => latest does nothing when the updated package only has a
  changed timestamp
- ensure => '1.0,5.11-0.151006:20140220T084443Z' is always applied,
  because it's not string equal to what puppet thinks is the installed
version ('1.0-0.151006'); this causes pkg(1) to exit with status 4,
which makes puppet throw an error
- ensure => '1.0-0.151006' sort of works; on the first run, it installs
  the latest available matching version (due to pkg(1) working that
  way), and on subsequent runs does nothing. This can lead to subtle bugs
  where systems provisioned later do not necessarily have the same version
  of a package installed (ie. if a newer-timestamped one was released in
  the meantime).

This commit implements a provider-specific insync? for the pkg type.
Unfortunately it's not possible to fix this issue without allowing
less-than-explicit version numbers in ensure (because that's the
original behavior) without breaking backward compatibility. We try to
match the default behavior of pkg(1) when encountering
less-than-explicit versions in ensure, and throw warnings for such
implicit version matches.
(PUP-1270) don't fail implicit version install when is == :absent
(PUP-1270) add tests for implicit version ensures
(PUP-3520) Refactor Puppet OID registration to be explicit

Prior to this commit, the Puppet::SSL::Oids module would register with
OpenSSL the list of special Puppet OIDs every time it was
loaded (i.e. implicitly during require 'puppet/ssl/oids'). This commit
refactors the registration calls into a module method that is invoked
from the following application faces: agent, master, cert, certificate,
and ca.

The reason for this refactoring is to try and avoid all implicit calls
into OpenSSL so that it is easier to eliminate/avoid the OpenSSL usage
when the Puppet ruby code is loaded into Puppet Server.

Since Puppet OID registration is no longer automatic, tests that rely on
CSR extensions using the Puppet OIDs must explicitly register them for
use. This is necessary since the tests do not go through any of the
application faces where the OID registration has already been taken care of.
(maint) PUP-3638 clarify puppet-doc manpage re: rdoc on manifests

remove the manifest examples and related doc
this functionality has been removed in PUP-3638
(PUP-2563) Gracefully exit on ruby 187

Previously, running puppet on ruby 187 would fail in an unhelpful way:

    in `const_defined?': wrong number of arguments (2 for 1) (ArgumentError)

Since users have historically installed puppet using whatever ruby
version happens to be installed, we want to ensure puppet displays a
useful error message that ruby 1.9.3 or greater is required.

This commit puts the check in lib/puppet.rb, which handles the various
puppet entry points: when executing the `puppet` command, when using
puppet as a library, e.g. `require 'puppet'`, and via passenger's
config.ru. In the `puppet` command case, we need to rescue the
LoadError, print the error message and exit. In the other two cases, we
let the application decide how it wants to handle the LoadError.
Merge pull request #3319 from nwolfe/maint/master/pup3520-refactor-oid-registration

(PUP-3520) Refactor Puppet OID registration to be explicit
Merge pull request #3381 from er0ck/maint/master/PUP-3638-remove_manifest_rdoc_from_doc_manpage

(maint) PUP-3638 clarify puppet-doc manpage re: rdoc on manifests
Merge pull request #3132 from lotheac/ips_fmri_parse

(PUP-1270) Use full IPS package version matching
Merge pull request #3267 from jasperla/openbsd/group

(PUP-3605) use correct usermod flag on OpenBSD for group management.
Merge pull request #3379 from joshcooper/ticket/master/PUP-2563-187-error-message

(PUP-2563) Gracefully exit on ruby 187