(PUP-1426) Disallow Puppet SSL autodefenestration

The puppet cert command supports an '--all' and a '--signed' flag so
that operations take take a list of values can operate on matching
values without having to enumerate them. However these options would
also apply to the 'clean' and 'revoke' actions. This means that
accidentally running `puppet cert clean --all` promptly and without
warning revokes and then removes all certificates. In other parlance,
this kills the CA.

Because this command is extremely dangerous and doesn't have any sane
use cases that we could determine, this commit disallows using
'--signed' or '--all' with the 'clean' or 'revoke' options. If this
functionality is needed we can add a '--force' flag to allow this
operation later.
(PUP-3676) Move OpenSSL::X509::Name calls in util/ssl.rb

This commit moves the initialization of a couple of constants in
`Puppet::Util::SSL` down into the body of the `subject_from_dn` method.

The purpose of the change is to avoid having this initialization, which
involves creating `OpenSSL::X509::Name` objects, be done when Puppet is
running under Puppet Server.  We've been trying to avoid calls into
JRuby OpenSSL as doing so has caused many problems for Puppet Server.

The `subject_for_dn` method is the only code which referenced these
constants and `subject_for_dn` is only called by the Rack HTTP handler,
which is not used by Puppet Server.
(PUP-2628) Add members to groups instead of full list for Windows

Previously, if you wanted to use the group resource you needed to specify the
entire list of members as the windows provider ignored the auth_membership
setting and was always the authoritative list. This ensures that the windows
provider respects the auth_membership setting.
(PUP-1293) Don't ignore status when using upstart provider

Since the upstart provider is overriding the status function,
it also overrides the default behaviour from the base service provider.

With this patch, if the status resource exists or hasstatus is set to false,
the default behaviour, from the base provider, will be invoked.
(maint) Remove unused scope from closure call_by_name

The big removal of 3x parser/ast missed to remove the unused scope
that was present in Closure#call_by_name.

This commit removes the unused scope, and corrects a typo in code that
supports use cases not yet merged to master (if invoked would cause a
hard stop on undefined variable 'scope').
(PUP-1362) (PUP-1775) remove :python command

No longer needed after removal of yumhelper.py
(PUP-1362) (PUP-1775) map yumhelper.py's -e & -d flags to yum

The -e & -d flags to yumhelper.py had different semantics than yum's -d & -e
flags.  The yum equivalent option flags are --enablerepo & --disablerepo.
(PUP-3700) Deactivate invalid actions on faces

Instead of documenting that certain actions are invalid they should
be removed instead.

Add the deactivate_action on faces to do this
(maint) use opencsw for ruby19 temporarily on solaris11

This change installs ruby19 on solaris11 from opencsw.
Without this change acceptance cannot run.
Once the vmpooler templates are update to solaris11.2
this should be replaced with a more "native" ruby19 installation.
(PUP-1640) Add technology agnostic way of plugging in data modules/env

This adds extension points for plugging in and specifying use of
an implementatio of a data provider for environment and for modules.
The implementation allows one provider per environment, and one per
module.

This only adds the mechanism - it is configured, but not yet used.
(PUP-1640) Add seting to opt in to an environment based data provider

This adds the setting :environment_data_provider which is the name of a
registered provider (values are 'none' or 'function' by default).
(PUP-1640) Add Data Providers for environment and modules

Includes tests that:

* assert that data from a module has lower precedence that data from
  an environment
* the function data mechanism works for both env and module
* the function data mechanism calls the expected functions
* the configuration of extensions allowing the specification of
  data mechanism works for env and module.
* the data functions must return hash
Merge pull request #3340 from er0ck/maint/master/temporary_ruby19_install_method_for_sol11

(maint) use opencsw for ruby19 temporarily on solaris11
(PUP-3676) Memoized dn_parser and no_name in Puppet::Util::SSL

This commit promotes `dn_parsers` and `no_name` back to being
class-level and ensures that they are only initialized once rather than
being reinitialized on each call to `subject_from_dn`.

This commit also removes the fallback `lambda` no_name parser from
`subject_from_dn` and instead just ensures that `no_name` is returned
whether the dn is "not possibly valid" or if none of the
`OpenSSL::X509::Name` parsers is able to parse the dn successfully.
(maint) Improve comment about "scope state" and closure
Merge pull request #3316 from camlow325/maint/master/PUP-3676-move-openssl-calls-in-ssl-rb

(PUP-3676) Move OpenSSL::X509::Name calls in util/ssl.rb
(maint) Add validation tests for top-level constructs in conditionals

In PUP-3274 some tests ended up "missing" (or at least hard to see
where certain behavior was asserted). This brings back three such
tests for testing that top-level constructs class, define and node
can not be defined inside of a conditional expression.

The tests are added to the validator_spec since it is responsible for
flagging these as errors.
(PUP-3701) Fix issue with empty exported resources expression

Resources in the catalog were being ignored and only found through the
indirector. This patch fixes that and makes the PuppetDB tests using
this feature pass.
Merge pull request #3343 from hlindberg/MAINT_add-tests-top-level-expr-in-conditionals

(maint) Add validation tests for top-level constructs in conditionals
Merge pull request #3344 from senior/ticket/stable/pup-3701-empty-resource-collection-expression

(PUP-3701) Fix issue with empty exported resources expression