(PUP-3117) Complete the implementation of resource expression

This completes the implenentation of the Resource Expression.

* The LHS must now be a QualifiedName (i.e. file, notify), or
  a QualifiedReference (i.e. File, Notify), or an access expression
  with a left QualifiedReference (i.e. Resource[file]), or literal
  'class'

* The result of the LHS must be a CatalogEntry type, and it may not
  be detailed to title level.

* The * => syntax can be used to to unfold a hash. It may be used
  once per titled resource body. Attribute names must be unique across
  the attributes set with name => expr, and those set with * => hash.
(maint) Remove unused issue codes APPEND_FAILED, and DELETE_FAILED
(maint) Fix faulty issue ILLEGAL_NUMERIC_PARAMETER and validation

There was a typo in the message that referenced a non existing variable.
This was undetected because there was no test to cover this.

When testing the expected behavior, it was found that the validation
was not correct as it allowed parameters to have hexadecimal names, but
not octal names. Now all numeric parameter names are disallowed (they
cannot be used or addressed anyway).
(maint) Fix bad comment for issue ILLEGAL_VARIABLE_EXPRESSION
PUP-3128: enabled pacman as default provider for manjarolinux

Change-Id: I4205d3e524e1bb37ac7337e18266910daaa603ed
(PUP-3151) Added acceptance test for External CA on Jetty

This commit adds an acceptance test which exercises External CA
functionality against a Jetty configuration.
Merge pull request #3022 from kylog/issue/pup-2349/cleanup-warning-during-pluginsync

(PUP-2349) cleanup warning during pluginsync.
Merge pull request #3001 from haus/ticket/master/pup-3035-add-var-run-puppet-to-debian-packaging

(PUP-3035) Add /var/run/puppet to debian packaging
(PUP-3154) Create and manage the mode of $statedir on redhat

In debian, we create and manage the $statedir in the postinst of the
puppet-common package. In redhat, $statedir would be created on
service start, and owned by root. This means that other applications,
even those in the puppet group, could not write to this directory. This
commit adds $statedir to the directories created in the redhat package
and sets the user and group ownership to puppet:puppet. This will ensure
a more consistent experience for users of our packages.
(PUP-1884) Migrate MSI deps into puppet repo

We have this problem where it is very difficult to know what exactly is
getting into the Puppet MSI when we build it. Previously, all that
information was stored in the Jenkins job used to build the MSI. This
proved difficult because there is no real way to audit changes made to
Jenkins jobs, why those changes were made, or who made them. This commit
moves that information into the Puppet Repo itself. This will help us
make sure the correct version of each project is getting into the MSI,
and allow us to build the MSI with the current checkout of the Puppet
Repo. However, this means we have to make sure we do not forget to
update the versions of the dependencies getting pulled into the MSI when
a new release happens.
Merge pull request #3030 from haus/ticket/master/pup-3154-manage-statedir-in-redhat-packaging

(PUP-3154) Create and manage the mode of $statedir on redhat
Merge pull request #3020 from melissaanne/ticket/master/pupet-1884

(PUP-1884) Migrate MSI deps into puppet repo
(PUP-2984) Remove old installation directory when going from x64 to x86

Update dependency on puppet_for_the_win:

https://github.com/puppetlabs/puppet_for_the_win/commit/c61dda253b09bd855488f7b6dd7332fdf84d3039
(PUP-3153) Guard against nil when closing Uniquefiles

In a recent commit we introduced `Uniquefile` to use in place
of `Tempfile` for certain code paths.  Because `Uniquefile` does
not automatically delete files for you, it is necessary to call
`close!` explicitly if you wish to make sure that they get
removed.

In the original commit I did this in a few places in an `ensure`
block.  However, I did not guard against the possibility that
an error might occur when attempting to instantiate the `Uniquefile`
object (e.g., file permissions error), and thus the calls to `close!`
in the `ensure` blocks may result in a NilClass exception (and also
mask the real error).

This commit adds guards to ensure that we only try to call `close!`
if the `Uniquefile` object was actually instantiated.
PUP-3155 Improve spec tests around the PE puppet version

Before this commit, when checking the puppet version on a PE build,
several characters; '(', ')' and '.'; caused problems with the regex.
This commit Regexp.escape-s them.
Merge pull request #3029 from cprice404/bug/master/PUP-3153-guard-against-nil-when-closing-uniquefiles

(PUP-3153) Guard against nil when closing Uniquefiles
Merge pull request #3031 from andersonmills/fix/master/PUP-3155-improve_pe_version_spec_tests

PUP-3155 Improve spec tests around the PE puppet version
(PUP-3157) Allow variable DNS name order in helpful error cert name test

This commit updates the
`helpful_error_message_when_hostname_not_match_server_certificate.rb`
test to allow for the order in which the DNS names are enumerated back
from the master server's certificate to be variable.  This allows the
test to not errantly fail depending upon the order in which the names
were actually signed into the certificate.
(PUP-3069) Add default manifest settings

Some Puppet installations do not use environment specific manifests
(particularly when an ENC is in use), however may still have global
setup required for all environments. For these installations it is
convenient to have a :default_manifest setting specified rather than
copying them manifest into every environment.

There are also installations which have a separation of roles between
users mainting the puppet master, puppet.conf and enc, and users making
per environment module changes. In these cases some Puppet installations
prefer to restrict the use of per environment manifests.

These two use cases were handled by setting the global manifest to a
non-interpolated path while setting the global modulepath to a path
interpolated with $environment.

With these settings being deprecated, directory environment
installations did not provide a means of preserving this functionality.

This patch addresses this by providing two new settings:

* default_manifest - is now the fallback manifest path if non is
specified in a given environment's environment.conf. It defaults to the
environment root relative path './manifests' which is the same default
that was previously hardset in early version of directory environments.
* restrict_environment_manifest - if set to true, enforces that
environments cannot define their own manifest setting, and validates
that default_manifest is set to an absolute path.

It is an initialization error if default_manifest is set to a string
that has an '$environment' to be interpolated within it.

We also log an error if restrict_environment_manifest is true and the
loaded environment's environment.conf has a manifest setting that
differs from the default_manifest setting.
(PUP-3069) Add spec test for new default options

Added tests for checking that default_manifest behaves properly when
given $environment. Also when restrict_environment_manifest is true with
a non-relative default_manifest.

This commit also fixed the hook on the :default_manifest setting to
validate that $environment was not present when setting the value.