(PUP-1426) Disallow Puppet SSL autodefenestration

The puppet cert command supports an '--all' and a '--signed' flag so
that operations take take a list of values can operate on matching
values without having to enumerate them. However these options would
also apply to the 'clean' and 'revoke' actions. This means that
accidentally running `puppet cert clean --all` promptly and without
warning revokes and then removes all certificates. In other parlance,
this kills the CA.

Because this command is extremely dangerous and doesn't have any sane
use cases that we could determine, this commit disallows using
'--signed' or '--all' with the 'clean' or 'revoke' options. If this
functionality is needed we can add a '--force' flag to allow this
operation later.
(PUP-3605) Add new OpenBSD user provider

This new provider is now needed because of the '-S' flag to usermod as well as
the different way expiry is set.
(PUP-1270) downgrade IPS packages in-place instead of uninstall-reinstall

Only use 'pkg install' when the package is absent, and 'pkg update'
otherwise. pkg(1) can do both downgrades and upgrades this way.
(PUP-1270) Use full IPS package version matching

Originally, the pkg provider would only consider IPS versions partially,
eg. '1.0-0.151006', due to not calling pkg(1) with -v. This version
string is missing the "build version" and "timestamp" (documented in
pkg(5)). This causes several issues:

- ensure => latest does nothing when the updated package only has a
  changed timestamp
- ensure => '1.0,5.11-0.151006:20140220T084443Z' is always applied,
  because it's not string equal to what puppet thinks is the installed
version ('1.0-0.151006'); this causes pkg(1) to exit with status 4,
which makes puppet throw an error
- ensure => '1.0-0.151006' sort of works; on the first run, it installs
  the latest available matching version (due to pkg(1) working that
  way), and on subsequent runs does nothing. This can lead to subtle bugs
  where systems provisioned later do not necessarily have the same version
  of a package installed (ie. if a newer-timestamped one was released in
  the meantime).

This commit implements a provider-specific insync? for the pkg type.
Unfortunately it's not possible to fix this issue without allowing
less-than-explicit version numbers in ensure (because that's the
original behavior) without breaking backward compatibility. We try to
match the default behavior of pkg(1) when encountering
less-than-explicit versions in ensure, and throw warnings for such
implicit version matches.
(PUP-3676) Move OpenSSL::X509::Name calls in util/ssl.rb

This commit moves the initialization of a couple of constants in
`Puppet::Util::SSL` down into the body of the `subject_from_dn` method.

The purpose of the change is to avoid having this initialization, which
involves creating `OpenSSL::X509::Name` objects, be done when Puppet is
running under Puppet Server.  We've been trying to avoid calls into
JRuby OpenSSL as doing so has caused many problems for Puppet Server.

The `subject_for_dn` method is the only code which referenced these
constants and `subject_for_dn` is only called by the Rack HTTP handler,
which is not used by Puppet Server.
(PUP-2628) Add members to groups instead of full list for Windows

Previously, if you wanted to use the group resource you needed to specify the
entire list of members as the windows provider ignored the auth_membership
setting and was always the authoritative list. This ensures that the windows
provider respects the auth_membership setting.
(PUP-1293) Don't ignore status when using upstart provider

Since the upstart provider is overriding the status function,
it also overrides the default behaviour from the base service provider.

With this patch, if the status resource exists or hasstatus is set to false,
the default behaviour, from the base provider, will be invoked.
(PUP-3274) Make 4x recursive directory import the standard.

This behavior was conditional to the future parser being used.
With 3x, only the top level directory was scanned for .pp files
to import, and when future parser was in effect, the search for
.pp files were recursive.

Now the future parser behavior is standard.
(PUP-3274) Make the defined function support 4x arguments as standard

The defined function in 3x with future parser added support for type
references. This commit makes this behavior standard in 4x.
(PUP-3274) Make lookup function be available as standard.

The lookup function was conditional on future parser being used.
It is now always available.
(PUP-3274) Make handling of strict_variable the 4x way standard.

The handling of the strict_variables option was different in 3x
and 4x where the later used a more performant throw construct.

This commit makes this behavior standard.
(PUP-3274) Make the 4x handling of relatie references standard.

When the future parser was in effect, all references to resources are
made absolute (as well as asserted to have the correct form). This
change make the 4x handling of references (for functions include,
contain, require, and hiera_include) have the 4x behavior.

As a consequence, tests that have not earlier been executed with the
setting Puppet[:parser] = 'future' have been changed to reflect the
change in behavior.
(PUP-3274) Make the 4x scope to hash be the standard

The 3x scope.to_hash produced a hash using dynamic scoping rules.
The 4x implementation does not do this.
(PUP-3274) Make the context initialization in compiler use 4x

This changes the initialization of the puppet context to always
use the 4x context initialization (making injector and 4x loaders
always be available via the context used when compiling).

This is the behavior that was in effect when parser future was used.
(PUP-3274) Make Puppet::Resource use 4x semantics as standard

This turns on checking of typed parameters and removes the unwrapping of
a single value array. This is the behavior that was used when future
parser was in effect. It is now the standard way.
(PUP-3274) Make all spec tests run parser future by default

This changes the default parser setting to 'future' thereby making
all tests that are not explicit about future/current parser to run
with the future parser.

This is one step in the direction of making the future parser the
one and only parser.

Tests that are no longer needed (only running for parser current
and covered by other spec tests for future parser have been remvoved,
and tests that fail because of syntax and semantic changes have been
updated.

The future_compiler_spec has been renamed to compiler4_spec.
(PUP-3274) Make lookup function's support 4x compliant as standard

When future parser is in effect, the return value is nil. This commit
removes the alternative return of undef in this case. It also removes
the extra bi directional transformation support between nil and undef.
(PUP-3274) Make binder's plugin configuration standard

This removes the conditional initialization based on parser being
set to future. Now the configuration is always initialized.
(PUP-3274) Remove future parser condition for performing type check

The type's parameter type checking was only available if the
future parser was in effect. Now it is always in effect.
(PUP-3274) Remove testing of parser == current code path

This removes testing the parser == current code path and removes
Puppet[:parser] = 'future' settings from tests that no longer need this.