allow primary to clean jrubies code cache after code deployment

[marcusdots]

On a default installation the primary should be able to clean its own code cache.
This enables OpenVox to work with r10k/g10k and a post deployment hook, e.g.

h=$(puppet config print certname)

curl -k -X DELETE \
  --cert /etc/puppetlabs/puppet/ssl/certs/$h.pem \
  --key  /etc/puppetlabs/puppet/ssl/private_keys/$h.pem \
  --cacert /etc/puppetlabs/puppet/ssl/ca/ca_crt.pem \
  https://$h:8140/puppet-admin-api/v1/environment-cache

[bastelfreak]

@Sharpie @binford2k @silug do you have an objection here? IMO it makes sense to allow this in the default config.

@marcusdots after this is merged, we should update the template in the theforeman/puppe-puppet repo as well.

[rwaffen]

LGTM

[OpenVoxProjectBot]

Successfully created backport PR for 8.x:

• [Backport 8.x] allow primary to clean jrubies code cache after code deployment #645

[Sharpie]

Seems like the best solution at the moment. Would be nice to have a dedicated permission for this, but that would also require everyone to update their certificates to add a new admin bit.

[nmburgan]

Also note, I think upgrades aren't going to get the new rule because I believe auth.conf is a file that doesn't get replaced by the package, so people would have to add it manually. Also, this would need to be modfieid in packaging/resources/files/config/conf.d/auth.conf in the vanagon PR I have open at #643.

[marcusdots]

@nmburgan I ported auth.conf to your branch:
535e164