(PUP-2660) user: set the user should-value when generating ssh_authorized_keys

When purging authorized SSH keys, the user type generates ssh_authorized_keys
resources using eval_generate. The ensure property receives a should value of
"absent" so the keys are removed. However, those resources are non-functional
because the user property lacks a should value. The resource fails during
Provider::Ssh_authorized_keys::Parsed#flush.

Fixed by setting the appropriate user value for each generated key.
Merge remote-tracking branch 'ffrank/ticket/3.6.1/PUP-2660-keys-not-purged-missing-user' into stable

* ffrank/ticket/3.6.1/PUP-2660-keys-not-purged-missing-user:
  (PUP-2660) user: set the user should-value when generating ssh_authorized_keys
(PUP-2659) Synchronize all webrick requests.

Puppet had some scattered thread safety code, which was removed in
4da350b, because Puppet itself is not using threads.  However, Webrick
starts a new thread to handle each incoming request.  This was probably
causing subtle problems during simultaneous requests to a webrick
master, but since 3.6.1 the issue became much more noticeable due to the
fix for PUP-2610 merged in 0dc5ad3 which was fixing a case where rack
masters would lose track of newly established environment loaders using
the master settings.  The change to Puppet::Context used a new
mark/rollback method for overriding context making it very obvious when
concurrent threads would collide attempting to rollback the same marker
and exhaust the context stack.

We are fixing this by synchronizing around incoming webrick requests,
effectively serializing their access to Puppet's innards.  Initial
manual benchmarking did not show a significant decrease in performance,
probably because Ruby uses green threads handled by the vm which cannot
take advantage of multiple processors.
(PUP-2659) Add a concurrency acceptance test

It is difficult to test concurrent requests with Beaker as it does not
allow parrallel requests to be made.  I'm using backgrounded subprocess
in a shell script to get around this, and I'm only making direct catalog
requests via curl, since an agent will halt if it spots another's pidfile in
existence on the same node.  Still, this is one of the major calls that
the agent makes, and it does effectively expose PUP-2659 on a
non-synchronized webrick master.
(PUP-2639) Change default timeout to 3 minutes

The 5 second timeout was selected assuming that the major use case would
be around a development workflow in which a user edits manifests on a
master and then immediately runs an agent to see the effect. It turns
out that this caused a lot of problems for a much more common and
impactful case of users updating to directory environments where they
ended up with excessive CPU usage. Nearly any value here is arbitrary
except 0 (purely development workflow) and unlimited (best choice for
production systems).

This makes the almost arbitrary decision that a 3 minute timeout will
create less confusion for upgrading users. It means that a development
workflow will require more restarts, however. :(
Merge pull request #2710 from zaphod42/feature/stable/pup-2639-increase-environment-timeout

(PUP-2639) Change default timeout to 3 minutes
(PUP-2692) Cache function info with the functions

The Puppet::Parser::Functions code used to hold onto two different sets
of information about the loaded functions: a hash of environment name to
environment module, and a hash of *environment* to a hash of function
name to function information. It was assumed that the
Puppet::Node::Environment class was written to properly work as a hash
key since it implemented both hash() and ==(). This assumption being
true would have meant that different instances for the same environment
would be the same key and the second hash above would not grow beyond a
reasonable size for the number of environments.

It turns out that to be a proper hash key a class must implement hash()
and eql?() (not ==()). Because Puppet::Node::Environment didn't do this
the hash of function information would just continually grow when
directory environments with an environment_timeout != unlimited was in
use. This is because the Puppet::Node::Environment instance would be
periodically thrown out by the Puppet::Environments::Cached loader and
be recreated, but the Puppet::Parser::Functions hash would hold onto the
old instance.

The fix for this here is to consolidate all of the function information
into a single structure. The function modules now have a few methods to
get the function metadata instead of it being stored separately. This is
completely backwards compatible and does not conflict with any existing
uses of the environment modules since the new methods are on the module
itself and will not be part of the mixin.
(PUP-2692) Correctly implement environment equality

This fixes environment equality to make it work as a hash key. It also
adds tests around this functionality.
Merge pull request #2708 from jpartlow/issue/stable/pup-2659-synchronize-webrick-rest

Issue/stable/pup 2659 synchronize webrick rest
Merge pull request #2714 from zaphod42/issue/stable/pup-2692-memory-leak-in-master

(PUP-2692) Fix memory leak in directory environments
(PUP-2635) use generate instead of eval_generate to purge ssh keys

The generating of ssh_authorized_keys resources for purging is implemented
in Puppet::Type::User#eval_generate. The resources are added as the graph
is being traversed.

This exhibits unexpected behavior under certain circumstances. Specifically,
generated keys can be considered already absent (and hence in sync) if there
is a package resource in the catalog. The error disappears when the
functionality is moved from the eval_generate hook in favor of the generate
hook.

The reasons for the wrong behavior is an issue between the transaction code
and the eval_generate mode of operation. During evaluation, the transaction
will call its #prefetch_if_necessary hook for each resource in turn, which
relies on #resources_by_provider. The latter has a cache and misses all
resources that are added using eval_generate after the initial method call.
As a result, those resources are not passed to the provider for prefetching
and thus remain in an uninitialized state, just as though the resource
would not exist on the target system (ensure => absent). They are therefor
not eligible for syncing/purging.
(PUP-2635) integration test for the purging of authorized ssh keys

Compile manifests that purge keys from a specific file and verify
their effect. Adds a test that detects the eval_generate problem
fixed in this branch.