(PUP-1426) Disallow Puppet SSL autodefenestration

The puppet cert command supports an '--all' and a '--signed' flag so
that operations take take a list of values can operate on matching
values without having to enumerate them. However these options would
also apply to the 'clean' and 'revoke' actions. This means that
accidentally running `puppet cert clean --all` promptly and without
warning revokes and then removes all certificates. In other parlance,
this kills the CA.

Because this command is extremely dangerous and doesn't have any sane
use cases that we could determine, this commit disallows using
'--signed' or '--all' with the 'clean' or 'revoke' options. If this
functionality is needed we can add a '--force' flag to allow this
operation later.
(PUP-3605) Add new OpenBSD user provider

This new provider is now needed because of the '-S' flag to usermod as well as
the different way expiry is set.
(PUP-1270) downgrade IPS packages in-place instead of uninstall-reinstall

Only use 'pkg install' when the package is absent, and 'pkg update'
otherwise. pkg(1) can do both downgrades and upgrades this way.
(PUP-1270) Use full IPS package version matching

Originally, the pkg provider would only consider IPS versions partially,
eg. '1.0-0.151006', due to not calling pkg(1) with -v. This version
string is missing the "build version" and "timestamp" (documented in
pkg(5)). This causes several issues:

- ensure => latest does nothing when the updated package only has a
  changed timestamp
- ensure => '1.0,5.11-0.151006:20140220T084443Z' is always applied,
  because it's not string equal to what puppet thinks is the installed
version ('1.0-0.151006'); this causes pkg(1) to exit with status 4,
which makes puppet throw an error
- ensure => '1.0-0.151006' sort of works; on the first run, it installs
  the latest available matching version (due to pkg(1) working that
  way), and on subsequent runs does nothing. This can lead to subtle bugs
  where systems provisioned later do not necessarily have the same version
  of a package installed (ie. if a newer-timestamped one was released in
  the meantime).

This commit implements a provider-specific insync? for the pkg type.
Unfortunately it's not possible to fix this issue without allowing
less-than-explicit version numbers in ensure (because that's the
original behavior) without breaking backward compatibility. We try to
match the default behavior of pkg(1) when encountering
less-than-explicit versions in ensure, and throw warnings for such
implicit version matches.
(PUP-2628) Add members to groups instead of full list for Windows

Previously, if you wanted to use the group resource you needed to specify the
entire list of members as the windows provider ignored the auth_membership
setting and was always the authoritative list. This ensures that the windows
provider respects the auth_membership setting.
(PUP-1293) Don't ignore status when using upstart provider

Since the upstart provider is overriding the status function,
it also overrides the default behaviour from the base service provider.

With this patch, if the status resource exists or hasstatus is set to false,
the default behaviour, from the base provider, will be invoked.
(PUP-3700) Deactivate invalid actions on faces

Instead of documenting that certain actions are invalid they should
be removed instead.

Add the deactivate_action on faces to do this
(PUP-1640) Add technology agnostic way of plugging in data modules/env

This adds extension points for plugging in and specifying use of
an implementatio of a data provider for environment and for modules.
The implementation allows one provider per environment, and one per
module.

This only adds the mechanism - it is configured, but not yet used.
(PUP-1640) Add seting to opt in to an environment based data provider

This adds the setting :environment_data_provider which is the name of a
registered provider (values are 'none' or 'function' by default).
(PUP-1640) Add Data Providers for environment and modules

Includes tests that:

* assert that data from a module has lower precedence that data from
  an environment
* the function data mechanism works for both env and module
* the function data mechanism calls the expected functions
* the configuration of extensions allowing the specification of
  data mechanism works for env and module.
* the data functions must return hash
(PUP-3624) Refactor log setup

Previously, the cert, doc, and face based applications had the same
logic for checking if `--verbose` or `--debug` was specified on the
command line, and setting the log level appropriately.

This commit refactors those applications to just call the
`Puppet::Application#set_log_level` method instead. The doc application is
a little bit unique in that it changes the default log level from
`notice` to `warning`, and it explicitly sets a console log destination.
(PUP-3624) Log at least at info level when --verbose is specified

The change for PUP-2998 means if you have `log_level=debug` in your
puppet.conf, then `puppet agent --test` will reduce the log level to info,
because `--test` implies `--verbose`.

This commit changes the semantics of `--verbose` (and `--test`) so that
we log *at least* at that level, but we won't downgrade.  This affects
all Puppet::Applications, e.g. puppet apply, agent, etc.

Note this wasn't an issue before PUP-2998 was implemented, because
log_levels could only be specified on the command line.
(PUP-3702) fix zone type on solaris10

Solaris10 does not inherit /sbin from the global zone by default.
This makes the zone un-bootable (ensure => running fails).
Add inherit => "/sbin" as a default to make solaris10 operate like
solaris11.
fixup the quotes on some tests to make them more consistent
(PUP-3436) Optimize CPU intensitive Compiler methods

This commit contains some performance optimizations in methods
that showed up as very time consuming in the profiler when running
the rake following rake tests:

benchmark:many_modules:run
benchmark:defined_types4:run
benchmark:defined_types:run

CPU consumption with this patch in place is between 70% - 75% of
what it used to be.

Profiling was performed using stackprof
https://github.com/tmm1/stackprof
(PUP-3436) Add optimized copy-constructor for Resource.

The Resource::copy_as_resource first created a new Resource
instance with all bells and whistles which means extracting
title, munching, and tagging. This commit ensures that these
fields are more effiently initialized when the source is
known to be a Resource.
(PUP-3436) Prevent unnecessary copying of tag sets.

This commit removes an unnecessary cloning of a tag set in the method
Puppet::Parser::Resource#add_scope_tags. It also removes unnecessary
processing of the tags since they have undergone this processing
already.
Merge branch 'PUP-3436_optimize-cpu-intensive-compiler-methods'
Merge pull request #3338 from dalen/invalid_face_actions

(PUP-3700) Remove invalid face actions.
Merge pull request #3033 from i-maravic/upstart-status-fix

(PUP-1293) Don't ignore status when using upstart provider
(maint) skip acceptance tests requiring forge certs on solaris and aix

the forge certificate was changed.  solaris does not yet have the new
certificates installed.  aix can not install the certs.
Users on these platforms have no good way of installing the
certificates.
skip these tests until we can test and/or the users have a method for
using the forge on these platforms.
Also, skip the legacy environment tests on these platforms prior to
legacy env removal.