(PUP-894) Accept CRLs that were "recently" updated

Previously, the agent would reject an SSL connection if the CRL it
downloaded from the CA had a `last_update` time that was slightly in the
future. The agent reports this as "CRL is not yet valid." This issue can
happen when the CA's time is slightly ahead of the agent's time, the CRL
is recently updated, and the agent doesn't already have a cached version
of the CRL (due to PUP-2103).

The CRL not yet valid error sometimes happens during acceptance testing
when we delete the agent's ssl directory, revoke a cert on the master
(which updates the CRL's last_update field), and run the agent (which
downloads the latest CRL).

This commit modifies the verify callback to ignore CRL not yet valid
errors provided all of the following are true:

 * current_crl is not nil
 * current_crl.last_update is not nil
 * current_crl.last_update is strictly less than 5 minutes from now

It also adds specs around unspecified behavior, e.g. ensure the verify
callback returns false when errors are detected.
(PUP-3222) Rescue StandardError instead of non-existent exception

Previously, the windows service provider rescued exceptions of type
Win32::Service::Error. However, FFI-based versions of win32-service (v0.8.x)
no longer raise that type of error. Instead they raise SystemCallError.

So previously, if puppet failed to manage a service, e.g. service didn't
exist, puppet would try to rescue the exception specifying a class that
was not defined:

    puppet resource service foo ensure=stopped
    Error: /Service[foo]: Could not evaluate: uninitialized constant Win32::Service::Error

This regression was introduced as part of PUP-1283 when we migrated from
win32-service version 0.7.x to 0.8.x.

This commit modifies the various provider methods to more broadly rescue
StandardErrors and updates the spec tests to handle the negative cases.

Paired-with: Ethan J Brown <ethan@puppetlabs.com>
Merge pull request #3063 from joshcooper/ticket/stable/PUP-3222-sytemcallerror

(PUP-3222) Rescue StandardError instead of non-existent exception
(PUP-3222) Rescue StandardError instead of SystemCallError

Commit c752a9ceea was supposed to rescue StandardErrors not
SystemCallErrors so that we do not break in the same way again
if the win32-service gem decides to raise a different exception.

This commit restores rescuing of StandardErrors.
(maint) Generate unique account names

Previously, the windows security_spec could fail if the same test was
executed in parallel, since the test assumed the account didn't exist.

This commit makes the names unique. The maximum length for local
user and groups accounts in 2003 is 20 and 256 characters[1],
respectively, and we remain below that limit in both cases.

[1] http://technet.microsoft.com/en-us/library/cc783323.aspx
(maint) Fix typos in comments in acceptance test
(PUP-3173) Fix old references to jvm-puppet in tests.

Signed-off-by: Wayne <wayne@puppetlabs.com>
(PUP-3175) Isolate yamldir for node/check_woy_cache_works.rb

Signed-off-by: Wayne <wayne@puppetlabs.com>
Merge pull request #3065 from jpartlow/issue/stable/pup-3162-whitelist-environment-interpolation

(PUP-3162) Issue/stable/pup 3162 whitelist environment interpolation
(maint) Disable activerecord testcase against puppet-server

Signed-off-by: Wayne <wayne@puppetlabs.com>
Merge branch 'pr/3069' into stable

* pr/3069:
  (maint) Disable activerecord testcase against puppet-server
  (PUP-3173) Fix old references to jvm-puppet in tests.

Closes GH-3069
Merge remote-tracking branch 'upstream/pr/3070' into stable

* upstream/pr/3070:
  (PUP-3175) Isolate yamldir for node/check_woy_cache_works.rb
(PUP-3136) Fix Intermittent Acceptance Test Failures

It was discovered that when puppet attempted to start apache the
provider would say that it was stopped even though it was starting. On
agents where a puppet master was installed with passenger the apache
service would take longer than usual to start lengthening the starting
process. By the time puppet tested if the service was running or not
apache would still be attempting to start causing the test to fail.

This commit replaces the apache2 package with rabbitmq since it is not
used by puppet and therefore tests down the road will not fail with us
managing it with puppet. It also uses a manifest instead of the
`puppet_resource` function to ensure that there is not any more timing
problems giving us the errors.
(PUP-3136) Add detailed exit codes to tests

This commit modifies the existing test to include detailed exit codes on
the `apply_manifest_on` step so that when the test fails errors will be
helpful.
Merge pull request #3071 from jpartlow/issue/stable/pup-3136-upstart-acceptance

Issue/stable/pup 3136 upstart acceptance
Merge pull request #3003 from TimWSpence/PUP-3128

PUP-3128: enabled pacman as default provider for manjarolinux
Merge pull request #3017 from jasperla/openbsd_service

Rewrite OpenBSD service provider with rcctl(8)
(PUP-3227) Address man page ownship conflicts

Prior to this commit, upgrading from puppet=2.7.23-1~deb7u3 and
puppetmaster=2.7.23-1~deb7u3 to puppet=3.7.0.29-1puppetlabs1 and
puppetmaster=3.7.0.29-1puppetlabs1 fails. I believe this problem is due
to how Debian chose to package puppet-common, which owns
`/usr/share/man/man8/puppet-master.8.gz`.

This commit adds in a `Conflicts:` to the puppetmaster and
puppetmaster-common packages to make sure that we can successfully
upgrade from these older package versions. However, if a user has
puppetmaster and puppet older than 3.3.0 installed on a machine, and
only upgrades puppetmaster, this will uninstall the puppet package from
the system.
(PUP-3228) Remove "{}" from PUPPETMASTER_EXTRA_OPTS and
PUPPET_EXTRA_OPTS in systemd files

The "{}" prevent systemd from interpreting values correctly and causes
services to fail to start
(maint) Clarify the error message when a relationship can't be established

The following error message:

    Error: Could not retrieve catalog from remote server: Could not intern
    from text/pson: Could not intern from data: Could not find relationship
    target "File[]"

Will get additional information:

    Error: Could not retrieve catalog from remote server: Could not intern
    from text/pson: Could not intern from data: Could not find relationship
    target "File[]" for Apache::Vhost[example.com]

So the error is easier to debug.