READY FOR REVIEW: This should extend support to PE 3.7

This has lots of moving parts, so *do not merge* until it has been
thoroughly tested on PE3.3 and PE3.4/7/whatever both.

Several of the conditional paths here can be eliminated once PE3.3 isn't
supported. For now, drop much of the directory environments bit behind a
guard and ignore it on $current.

The session timeout is configured under `console-services` now. Note: I'm managing this as a separate `rbac-classroom.conf` file. Nick says that we shouldn't depend on the directory style conf files to be supported in the future, but I have a pull request in to add ability to manage this with the built in PE modules out of the box. This should hit in PE 3.7.1.

The user Rake task has different parameters. This should account for
them. All the `console::*` defined type need to be rewritten to the REST
APIs once the old Console is dead, and/or we drop support for it. I will be writing a provider to support the REST calls soon.

Please, pull this branch in and test it locally on both supported major
PE releases and hammer on it hard. Let's make sure nothing breaks before
we merge it.

With the conditionals in place, once we merge, we should be able to make
a public release without breaking any current classrooms, giving PS the
opportunity to easily test and try out 3.7 before it drops.

Cautions:

* The initial Puppet run can take a very very long time due to restarting the stack and waiting for boot. See the `classroom::master::wait_for_startup` class for details.
* Environment cache does not update the list of classes available to the Node Classifier. To do that, you'll need to run the `refresh_classes.sh` script. This script is called automatically during the git `post-update` hook.
* Agent set environments no longer work without futzing. See https://tickets.puppetlabs.com/browse/PE-6621 for info. (The labs are being rewritten to use node groups instead)
* All nodes in the classroom, save the initial classroom master, are installed with the `setup_classroom.sh` script. Even the Architect masters.
* Always run `verify_classroom.sh master` prior to install, as it now does a time sync and warns you if there's no internet access.

Architect no longer does any of the certificate shopping. Things just work.

The `classroom::master::agent_tarball` class will require this fiddly change for internal testing until it is released. https://gist.github.com/binford2k/dada867a7b5844ff92a2

On the student masters, it will also require you to put a symlink in place for the secondary agent installer to run properly.

ln -s /opt/puppet/packages/public/puppet-enterprise-3.7.0-rc2-17-g5bdc6a6-el-6-i386-agent /opt/puppet/packages/public/puppet-enterprise-3.7.0-el-6-i386-agent