(PUP-1426) Disallow Puppet SSL autodefenestration

The puppet cert command supports an '--all' and a '--signed' flag so
that operations take take a list of values can operate on matching
values without having to enumerate them. However these options would
also apply to the 'clean' and 'revoke' actions. This means that
accidentally running `puppet cert clean --all` promptly and without
warning revokes and then removes all certificates. In other parlance,
this kills the CA.

Because this command is extremely dangerous and doesn't have any sane
use cases that we could determine, this commit disallows using
'--signed' or '--all' with the 'clean' or 'revoke' options. If this
functionality is needed we can add a '--force' flag to allow this
operation later.
(PUP-3605) Add new OpenBSD user provider

This new provider is now needed because of the '-S' flag to usermod as well as
the different way expiry is set.
(PUP-1270) downgrade IPS packages in-place instead of uninstall-reinstall

Only use 'pkg install' when the package is absent, and 'pkg update'
otherwise. pkg(1) can do both downgrades and upgrades this way.
(PUP-1270) Use full IPS package version matching

Originally, the pkg provider would only consider IPS versions partially,
eg. '1.0-0.151006', due to not calling pkg(1) with -v. This version
string is missing the "build version" and "timestamp" (documented in
pkg(5)). This causes several issues:

- ensure => latest does nothing when the updated package only has a
  changed timestamp
- ensure => '1.0,5.11-0.151006:20140220T084443Z' is always applied,
  because it's not string equal to what puppet thinks is the installed
version ('1.0-0.151006'); this causes pkg(1) to exit with status 4,
which makes puppet throw an error
- ensure => '1.0-0.151006' sort of works; on the first run, it installs
  the latest available matching version (due to pkg(1) working that
  way), and on subsequent runs does nothing. This can lead to subtle bugs
  where systems provisioned later do not necessarily have the same version
  of a package installed (ie. if a newer-timestamped one was released in
  the meantime).

This commit implements a provider-specific insync? for the pkg type.
Unfortunately it's not possible to fix this issue without allowing
less-than-explicit version numbers in ensure (because that's the
original behavior) without breaking backward compatibility. We try to
match the default behavior of pkg(1) when encountering
less-than-explicit versions in ensure, and throw warnings for such
implicit version matches.
(PUP-2628) Add members to groups instead of full list for Windows

Previously, if you wanted to use the group resource you needed to specify the
entire list of members as the windows provider ignored the auth_membership
setting and was always the authoritative list. This ensures that the windows
provider respects the auth_membership setting.
(PUP-1640) Add technology agnostic way of plugging in data modules/env

This adds extension points for plugging in and specifying use of
an implementatio of a data provider for environment and for modules.
The implementation allows one provider per environment, and one per
module.

This only adds the mechanism - it is configured, but not yet used.
(PUP-1640) Add seting to opt in to an environment based data provider

This adds the setting :environment_data_provider which is the name of a
registered provider (values are 'none' or 'function' by default).
(PUP-1640) Add Data Providers for environment and modules

Includes tests that:

* assert that data from a module has lower precedence that data from
  an environment
* the function data mechanism works for both env and module
* the function data mechanism calls the expected functions
* the configuration of extensions allowing the specification of
  data mechanism works for env and module.
* the data functions must return hash
(PUP-3624) Refactor log setup

Previously, the cert, doc, and face based applications had the same
logic for checking if `--verbose` or `--debug` was specified on the
command line, and setting the log level appropriately.

This commit refactors those applications to just call the
`Puppet::Application#set_log_level` method instead. The doc application is
a little bit unique in that it changes the default log level from
`notice` to `warning`, and it explicitly sets a console log destination.
(PUP-3624) Log at least at info level when --verbose is specified

The change for PUP-2998 means if you have `log_level=debug` in your
puppet.conf, then `puppet agent --test` will reduce the log level to info,
because `--test` implies `--verbose`.

This commit changes the semantics of `--verbose` (and `--test`) so that
we log *at least* at that level, but we won't downgrade.  This affects
all Puppet::Applications, e.g. puppet apply, agent, etc.

Note this wasn't an issue before PUP-2998 was implemented, because
log_levels could only be specified on the command line.
(PUP-3702) fix zone type on solaris10

Solaris10 does not inherit /sbin from the global zone by default.
This makes the zone un-bootable (ensure => running fails).
Add inherit => "/sbin" as a default to make solaris10 operate like
solaris11.
fixup the quotes on some tests to make them more consistent
(PUP-3718) Make defined function handle qualified variable names

The defined function can answer if a variable is defined. There
were however no tests for qualified variable names. The implementation,
when given a qualified name simply tried to lookup the complete name
in its own scope which naturally failed.

This commit adds logic to check if a variable is qualified in the
Scope#exist? method, and then mimics the behavior of a variable
lookup by splitting the name, then looking up the class and its scope
and finally delegating the exist? call to that scope.

This is made somewhat complicated when testing due to the fact how
scopes are wired (to find other names scopes). The test that checks for
the existence of a top scope variable now sets this up as if the main
class (called '') had been evaluated.
(PUP-3282) Remove support for method access to variables in ERB templ.

This removes the deprecated support to produce lookup of variable
names when a missing method was invoked having the same name as
the variable.

This is now an error, just like calling any other missing method.
Merge pull request #3351 from er0ck/fix/master/PUP-3702-fix_zone_type_on_solaris10

(PUP-3702) fix zone type on solaris10
(maint) Add rdoc dependency in Gemfile

Without this patch the Puppet spec tests fail to run using the system
ruby included with Enterprise Linux 7.  This is a problem because EL7 is
a supported platform and it is helpful to use the system packages to run
the Puppet spec tests.

The specific issue is the following from a jenkins job that simply runs
`bundle install --path .bundle/gems` and then `bundle exec rspec spec`.

    + bundle exec rspec spec -fd
    /var/lib/jenkins/jobs/puppet/workspace/.bundle/gems/ruby/gems/activesupport-3.2.19/lib/active_support/dependencies.rb:251:in `require': cannot load such file -- rdoc/rdoc (LoadError)
            from /var/lib/jenkins/jobs/puppet/workspace/.bundle/gems/ruby/gems/activesupport-3.2.19/lib/active_support/dependencies.rb:251:in `block in require'
            from /var/lib/jenkins/jobs/puppet/workspace/.bundle/gems/ruby/gems/activesupport-3.2.19/lib/active_support/dependencies.rb:236:in `load_dependency'
            from /var/lib/jenkins/jobs/puppet/workspace/.bundle/gems/ruby/gems/activesupport-3.2.19/lib/active_support/dependencies.rb:251:in `require'
            from /var/lib/jenkins/jobs/puppet/workspace/spec/unit/util/rdoc_spec.rb:5:in `<top (required)>'
            from /var/lib/jenkins/jobs/puppet/workspace/.bundle/gems/ruby/gems/rspec-core-2.14.8/lib/rspec/core/configuration.rb:896:in `load'
            from /var/lib/jenkins/jobs/puppet/workspace/.bundle/gems/ruby/gems/rspec-core-2.14.8/lib/rspec/core/configuration.rb:896:in `block in load_spec_files'
            from /var/lib/jenkins/jobs/puppet/workspace/.bundle/gems/ruby/gems/rspec-core-2.14.8/lib/rspec/core/configuration.rb:896:in `each'
            from /var/lib/jenkins/jobs/puppet/workspace/.bundle/gems/ruby/gems/rspec-core-2.14.8/lib/rspec/core/configuration.rb:896:in `load_spec_files'
            from /var/lib/jenkins/jobs/puppet/workspace/.bundle/gems/ruby/gems/rspec-core-2.14.8/lib/rspec/core/command_line.rb:22:in `run'
            from /var/lib/jenkins/jobs/puppet/workspace/.bundle/gems/ruby/gems/rspec-core-2.14.8/lib/rspec/core/runner.rb:80:in `run'
            from /var/lib/jenkins/jobs/puppet/workspace/.bundle/gems/ruby/gems/rspec-core-2.14.8/lib/rspec/core/runner.rb:17:in `block in autorun'

This patch addresses the problem by adding 'rdoc' to the set of
dependencies managed by bundler as a pre-requisite step prior to running
the spec tests.
(PUP-2904) Make functions 4 API require symbol param names

There was a mix of String and Symbol in our code. This enforces
that parameter names must be Symbol. Thus it is up to the caller to
use the right thing as this is better than performing an intern
(performance and may intern something big/bad).
(PUP-3680) Remove confusing convenience Hash[value-type]

In an attempt to be helpful, the type system offers a convenience
that if a Hash type is specified with one key, then this is taken
as being the type of the value (and the key type defaults to
Scalar).

In practice this proved to be confusing as it raises the question
about if it is the key type or the value type that is being
specified. Some users thought it was they key type, as that is
what they wanted control over, others thought it was the value type.

From a consistency standpoint (a Hash is a Collection), it could
be viewed as being a collection of Tuple[Key, Value], but implementing
that is not very helpful (it is just more to type). The best solution is
therefore to simply remove the convenience and require both Key and
Value type as a minimum. (This also removes the confusion over the error
if wanting to specify Hash[Value, 2,5] (which fails because 2 is not a
type). Now users have to specify the full type: Hash[Key, Value, 2, 5]
if they want to add min and max entries.
Merge pull request #3324 from ferventcoder/ticket/master/PUP-2628-group-windows-inclusive

(PUP-2628) Add members to groups instead of full list for Windows
(PUP-1270) don't fail implicit version install when is == :absent
(PUP-1270) add tests for implicit version ensures