DO NOT MERGE: This should extend support to PE 3.7

This has lots of moving parts, so *do not merge* until it has been
thoroughly tested on PE3.3 and PE3.4/7/whatever both.

This will currently fail on the master unless you manually
`/opt/puppet/bin/puppetserver gem install hocon`. This limitation should
be corrected by a fix to the `conffile` provider @cprice404 is working
on. Track that work at https://tickets.puppetlabs.com/browse/TK-105.

Several of the conditional paths here can be eliminated once PE3.3 isn't
supported. For now, drop much of the directory environments bit behind a
guard and ignore it on $current.

The session timeout is configured under `console-services` now. Note:
This is managed with Preben's `conffile` type, which uses Chris' `hocon`
gem. Because there's no good way to install the gem and use it in the
current run (contingent on testing, of course), I drop an icky nasty
guard fact in place and only manage this file on the second Puppet run.

The user Rake task has different parameters. This should account for
them. All the `console::*` defined type need to be rewritten to the REST
APIs once the old Console is dead.

This adds the `hacon` gem and the `preben-conffile` module to the cache
and updates the module dependencies.

Please, pull this branch in and test it locally on both supported major
PE releases and hammer on it hard. Let's make sure nothing breaks before
we merge it.

With the conditionals in place, once we merge, we should be able to make
a public release without breaking any current classrooms, giving PS the
opportunity to easily test and try out 3.7 before it drops.
Updates to keep up with puppet_enterprise dev

This assumes that my pull requests to update the `puppet_enterprise`
module will be accepted.
Support the ARchitect course too

* Use the build in certificate shopping of $current
* Set group params in the node classifier
Add agent tarball caching and other jazz

* makes simplified install work for all roles in the classroom
    * currently requires network to set up initially
    * clearly the master still needs the full installer
    * see https://tickets.puppetlabs.com/browse/TRAINVM-149
* also updates PE 3.7 support again
    * spaceship hack will be needed on release
    * session-timeout management will not make release
* remove `pe-console-services` and `pe-puppetserver` notifies
    * manual restart is required post classification
    * see https://tickets.puppetlabs.com/browse/TK-78
Horrible hack to workaround slow stack start.

The new PE stack takes a very long time to startup, which can cause
disconcerting errors. This simply schedules that to the end of the run
and waits for the service to resume servicing requests before allowing
the run to complete This ensures that if services are restarted, that
will happen *after* any resources that depend on them to be running
are enforced.

I'd appreciate comments from @acidprime @reidmv
Whoops! Forgot the path.

No longer an infinite loop ;)
Update setup scripts

* Update verification to insist on 4GB
* Change setup scripts to use standard install args instead of homegrown
  handoff classification for secondary agents.
* Clean up agent installer error handling a tiny bit.
* Add simple snapshot utility to get debugging info for @finch.
New external node classifier

* Deprecates the shell script as it no longer works
* Uses the POC from @nicklewis
    * https://gist.github.com/nicklewis/7a750cfa8985171ea18a
* Submits facts using a PuppetDB query
Let's start putting these in a better spot
not needed in current PE
Refactored the function call back out

This was silly to abstract
New helper scripts

* `refresh_classes.sh` pokes the node classifier to request cache update
* `snapshot.sh` is a debugging tool to help track down some SSL issues
allow to be run by non-root
Environment updates refresh class list

The post-update hook will call the refresh_classes.sh script if it
exists, causing the Node Classifier to refresh its list of available
classes. The script returns immediately, though it takes up to a few
minutes to fully refresh the cache depending on the load of the VM.
This is what happens when you write bash and ruby

...at the same time.
synchronize time
Silence the curl output

Makes the git hook less noisy
check the version properly
we don't need to manage modulepath anymore
Pin r10k to 'present' so it matches cached version