fixes #1994 - set vardir for puppet 3, use --configprint

When running Puppet 3 as a non-root user (i.e. foreman), both --confdir and
--vardir have to be specified as per Puppet #16637, else SSL settings dependent
on vardir will fail.

This adds a new puppetvardir setting used with puppetconfdir, and supports
puppetconfdir being a file or directory due to historic settings.yaml examples.

It now shells out and uses `puppet master --configprint` to retrieve settings
to avoid changes in Puppet settings initialization logic across versions (e.g.
run_mode on Puppet 3).