(PUP-3676) Move OpenSSL::X509::Name calls in util/ssl.rb

This commit moves the initialization of a couple of constants in
`Puppet::Util::SSL` down into the body of the `subject_from_dn` method.

The purpose of the change is to avoid having this initialization, which
involves creating `OpenSSL::X509::Name` objects, be done when Puppet is
running under Puppet Server.  We've been trying to avoid calls into
JRuby OpenSSL as doing so has caused many problems for Puppet Server.

The `subject_for_dn` method is the only code which referenced these
constants and `subject_for_dn` is only called by the Rack HTTP handler,
which is not used by Puppet Server.
(PUP-1293) Don't ignore status when using upstart provider

Since the upstart provider is overriding the status function,
it also overrides the default behaviour from the base service provider.

With this patch, if the status resource exists or hasstatus is set to false,
the default behaviour, from the base provider, will be invoked.
(maint) Remove unused scope from closure call_by_name

The big removal of 3x parser/ast missed to remove the unused scope
that was present in Closure#call_by_name.

This commit removes the unused scope, and corrects a typo in code that
supports use cases not yet merged to master (if invoked would cause a
hard stop on undefined variable 'scope').
(PUP-2927) Enable Facter debugging with debug option.

Enabling Facter debugging when the debug option is given to Puppet.
(PUP-2927) Enable Facter stack traces with trace option.

Enabling Facter stack traces when the trace option is given to Puppet.
(PUP-2927) Route Facter logging through Puppet's log.

If using a recent version of Facter that supports Facter.on_message,
Puppet will now route Facter's logging through Puppet's log with a
source of "Facter".

This supresses Facter debug/warning message output in favor of letting
Puppet handle the messages.  This also results in Facter's logging
ending up in the report.
(maint) Replace Facter[].value calls with just Facter.value.

There are a few remaining Facter[:name].value calls remaining.
We use the shortcut method Facter.value throughout Puppet's source, so
removing these calls in favor of the simplier Facter.value call.
(PUP-3700) Deactivate invalid actions on faces

Instead of documenting that certain actions are invalid they should
be removed instead.

Add the deactivate_action on faces to do this
Merge pull request #3331 from peterhuene/pup/2927

(PUP-2927) Improve Facter logging integration.
(maint) use opencsw for ruby19 temporarily on solaris11

This change installs ruby19 on solaris11 from opencsw.
Without this change acceptance cannot run.
Once the vmpooler templates are update to solaris11.2
this should be replaced with a more "native" ruby19 installation.
Merge pull request #3340 from er0ck/maint/master/temporary_ruby19_install_method_for_sol11

(maint) use opencsw for ruby19 temporarily on solaris11
(PUP-3676) Memoized dn_parser and no_name in Puppet::Util::SSL

This commit promotes `dn_parsers` and `no_name` back to being
class-level and ensures that they are only initialized once rather than
being reinitialized on each call to `subject_from_dn`.

This commit also removes the fallback `lambda` no_name parser from
`subject_from_dn` and instead just ensures that `no_name` is returned
whether the dn is "not possibly valid" or if none of the
`OpenSSL::X509::Name` parsers is able to parse the dn successfully.
(maint) Improve comment about "scope state" and closure
Merge pull request #3316 from camlow325/maint/master/PUP-3676-move-openssl-calls-in-ssl-rb

(PUP-3676) Move OpenSSL::X509::Name calls in util/ssl.rb
(maint) Add validation tests for top-level constructs in conditionals

In PUP-3274 some tests ended up "missing" (or at least hard to see
where certain behavior was asserted). This brings back three such
tests for testing that top-level constructs class, define and node
can not be defined inside of a conditional expression.

The tests are added to the validator_spec since it is responsible for
flagging these as errors.
(PUP-3701) Fix issue with empty exported resources expression

Resources in the catalog were being ignored and only found through the
indirector. This patch fixes that and makes the PuppetDB tests using
this feature pass.
Merge pull request #3343 from hlindberg/MAINT_add-tests-top-level-expr-in-conditionals

(maint) Add validation tests for top-level constructs in conditionals
Merge pull request #3344 from senior/ticket/stable/pup-3701-empty-resource-collection-expression

(PUP-3701) Fix issue with empty exported resources expression
(maint) Allow non-root users to traverse tmpdir

This test creates a tmpdir, initially owned by root:root and mode 0700,
and executes `puppet agent` with an ssldir contained within the tmpdir:

    puppet agent --ssldir /tmp/autosign_command.XXXX/ssldir-autosign

Puppet will manage the owner/group/mode of the ssldir (but not its
parent) by temporarily switching uid/gid to the `puppet` user & group,
create the directory, etc, and then switch back. If the parent
directory has mode 0700, then the `puppet` user is not allowed to create
a directory within the parent.

Previously, the test used puppet apply to switch the owner and mode of
the parent directory. This works by accident on some platforms, e.g.
Windows, because there is a setup step that will create the `puppet`
user and group.

But in PE, that is not the case, so this test would fail in PE on
Windows with the error:

    Could not write /tmp/autosign_command.jwi1dW/ssldir-autosign/\
      private_keys/hj6ml6atya3wuiz.delivery.puppetlabs.net-autosign.pem \
      to privatekeydir: Permission denied

This commit modifies the test to allow `group` and `other` read and
traverse permissions on the parent directory, and doesn't require the
existence of the `puppet` user.
Merge branch 'stable'