(maint) Add Equifax cert for pmt acceptance

The forge SSL certificates are being updated to use SHA-256, and that's
introduced a new certificate dependency that's not present on Windows.
Add it as part of acceptance testing. This is a stop-gap until the PMT
is fixed to come with its own certs.
Merge branch 'backport/stable/equifax-cert' into stable

* backport/stable/equifax-cert:
  (maint) Add Equifax cert for pmt acceptance
(PUP-3682) Disable HTTP keepalive in webrick on 1.8.7

Previously, webrick would attempt to support HTTP keepalive so that HTTP
clients could send multiple HTTP messages on the same TCP (SSL)
connection. However, we found in practice that RHEL6 with system ruby
1.8.7-p352 with openssl 1.0.1e-fips does not reliably handle keepalive.
Most commonly the webrick server fails to read the agent's report, or
sometimes fails when handling the agent's catalog request:

    Server Error: SSL_read:: internal error

This commit causes the webrick rest handler to always include the HTTP
header `Connection: close` in the HTTP response. This indicates to the
HTTP client that the webrick server does not want to keep the connection
alive, and that the client should make a new connection the next time it
connects.

This change does not affect webrick running under 1.9 or later, nor does
it affect puppet masters running under passenger or puppet-server. As
these do reliably handle HTTP keepalive, and we want the performance
benefit that persistent http connections provide.

Note 1.8.7 support will be going away in Puppet 4, so this is a
short-term fix to the 3.7.x series.
Merge pull request #3325 from joshcooper/ticket/stable/PUP-3682-disable-webrick-keepalive

(PUP-3682) Disable HTTP keepalive in webrick on 1.8.7
(PUP-3091) Add test coverage for heredoc support

Before this commit the spec tests for heredoc support in Puppet did not
include tests to make sure that escaping new lines used the correct
margin on the preceding lines.

This commit adds in tests to ensure that we do not regress on this in
the future.
Merge pull request #3327 from demophoon/fix/stable/pup-3091-heredoc-support

(PUP-3091) Add test coverage for heredoc support
(maint) Install CA certs during git and package runs

Previously, the step for installing CA certs was only run during "git"
acceptance runs. This step is needed for module related acceptance tests
to work on platforms that don't already trust the forge's root
certificate, notably on Windows.

This commit makes the setup step common for both git and packages. This
doesn't actually change anything for "packages" because the step is only
executed on Windows, and we don't yet test against packages on Windows.
It also makes it easier to add support for other agent platforms that
have the same issue, e.g. Solaris

This commit also fixes the misspelling in the file name.
Merge pull request #3328 from joshcooper/ticket/stable/maint-refactor-install-ca-certs

(maint) Install CA certs during git and package runs