* app.rb (/api): fix misplaced dup

When we generate the output for the commands in the entrypoint, we
erroneously modify the URL's for the command handlers in the @@commands
array. This leads to all commands having an 'id' containing the hostname
under which /api was accessed the very first time; all subsequent accesses
to /api will use that hostname, even if those accesses use a different
hostname.

As an example, if the first access is to http://localhost:8080/api, even
subsequent requests to http://razor:8080/api will use 'localhost' in the id
properties for commands.

The culprit for this behavior was that the entries in the @@commands array
were directly modified (as @@commands.dup makes a shallow copy, which is
pointless anyway since map creates a new array) With this change, the hash
for each command will not be modified, but a copy will be created and have
the id filled in appropriately.

In addition, to avoid this from happening again, we freeze the hash
describing each command.

Fixes https://tickets.puppetlabs.com/browse/RAZOR-93