(PUP-1839) Introduce overridden defaults

The previous behavior of setting the value of a configuration setting was
that the value only took effect if a user had not specified a value for
that setting on the command line. This caused lots of confusion and some
unsafe situations where the puppet code tries to override a setting in
order to continue.

This changes the precedence of setting values so that anything set in the
code is higher precedence than the cli values. In order to allow
overriding the defaults that are determined by hooks on settings, this
also adds in an `override_default(setting_name, value)` method so that the
hooks can create new defaults.

With this machinery in place the device application can now simply assign a new
value for the confdir, vardir, and certname settings rather than faking out
that the values are coming from the cli. This stops device from using the
deprecated API.