(PUP-1426) Disallow Puppet SSL autodefenestration

The puppet cert command supports an '--all' and a '--signed' flag so
that operations take take a list of values can operate on matching
values without having to enumerate them. However these options would
also apply to the 'clean' and 'revoke' actions. This means that
accidentally running `puppet cert clean --all` promptly and without
warning revokes and then removes all certificates. In other parlance,
this kills the CA.

Because this command is extremely dangerous and doesn't have any sane
use cases that we could determine, this commit disallows using
'--signed' or '--all' with the 'clean' or 'revoke' options. If this
functionality is needed we can add a '--force' flag to allow this
operation later.
(PUP-3605) Add new OpenBSD user provider

This new provider is now needed because of the '-S' flag to usermod as well as
the different way expiry is set.
(PUP-1270) downgrade IPS packages in-place instead of uninstall-reinstall

Only use 'pkg install' when the package is absent, and 'pkg update'
otherwise. pkg(1) can do both downgrades and upgrades this way.
(PUP-1270) Use full IPS package version matching

Originally, the pkg provider would only consider IPS versions partially,
eg. '1.0-0.151006', due to not calling pkg(1) with -v. This version
string is missing the "build version" and "timestamp" (documented in
pkg(5)). This causes several issues:

- ensure => latest does nothing when the updated package only has a
  changed timestamp
- ensure => '1.0,5.11-0.151006:20140220T084443Z' is always applied,
  because it's not string equal to what puppet thinks is the installed
version ('1.0-0.151006'); this causes pkg(1) to exit with status 4,
which makes puppet throw an error
- ensure => '1.0-0.151006' sort of works; on the first run, it installs
  the latest available matching version (due to pkg(1) working that
  way), and on subsequent runs does nothing. This can lead to subtle bugs
  where systems provisioned later do not necessarily have the same version
  of a package installed (ie. if a newer-timestamped one was released in
  the meantime).

This commit implements a provider-specific insync? for the pkg type.
Unfortunately it's not possible to fix this issue without allowing
less-than-explicit version numbers in ensure (because that's the
original behavior) without breaking backward compatibility. We try to
match the default behavior of pkg(1) when encountering
less-than-explicit versions in ensure, and throw warnings for such
implicit version matches.
(PUP-1640) Add technology agnostic way of plugging in data modules/env

This adds extension points for plugging in and specifying use of
an implementatio of a data provider for environment and for modules.
The implementation allows one provider per environment, and one per
module.

This only adds the mechanism - it is configured, but not yet used.
(PUP-1640) Add seting to opt in to an environment based data provider

This adds the setting :environment_data_provider which is the name of a
registered provider (values are 'none' or 'function' by default).
(PUP-1640) Add Data Providers for environment and modules

Includes tests that:

* assert that data from a module has lower precedence that data from
  an environment
* the function data mechanism works for both env and module
* the function data mechanism calls the expected functions
* the configuration of extensions allowing the specification of
  data mechanism works for env and module.
* the data functions must return hash
(PUP-3282) Remove support for method access to variables in ERB templ.

This removes the deprecated support to produce lookup of variable
names when a missing method was invoked having the same name as
the variable.

This is now an error, just like calling any other missing method.
(PUP-1270) don't fail implicit version install when is == :absent
(PUP-1270) add tests for implicit version ensures
(PUP-1640) Remove unused puppet model checker for catalog side effects

This removes the checker that is intended to check a puppet language
model for catalog side effects since it is not yet used. It can be added
again when functions written in the puppet language is added.
(PUP-1640) Fix formatting, typos, etc. found in review

* This removes the data.pp mentioned as the manifest in the
environment.conf file (unused and wrong)
* Typos in comments
* missing end of line on the last line in some source files.
(PUP=2563) Remove 1.8.7 explanatory comments from acceptance tests
(PUP-2563) Remove fix for pup-2478, which was 1.8-specific
(PUP-2563) Update quickstart.md for which rubies puppet supports
(PUP-2563) Remove 1.8 dependencies from Gemfile
(PUP-2563) Remove 1.8.7 support
(PUP-2563) Remove 1.8.7 monkey patches

This leaves some monkey patches related to 1.8.7 but tied to other
code removals (rdoc, activerecord). It also leaves in a couple that
I wasn't sure about, so there may be more monkey patches to prune.
(PUP-2563) Update unicode.md to reflect a post-1.8 world
(PUP-2563) Remove workarounds for 1.8 behavior for hash.selecdt