fix(MODULES-11727): Add puppet 9 support in puppetlabs-tomcat

[SugatD]

Summary

• Bump the puppet requirement upper bound in metadata.json from < 9.0.0 to < 10.0.0 to allow the module to be used with Puppet 9.
• Wire up the Gemfile/CI toolchain actually needed to exercise a Puppet 9 lane:
  • Gemfile: bump voxpupuli-puppet-lint-plugins to ~> 7.0 and puppetlabs_spec_helper to ~> 9.0. The old puppetlabs_spec_helper (8.0.0) pinned puppet-lint ~> 4.0, which doesn't run on Ruby 3.4+ (the Puppet 9 lane) and conflicts with plugins 7.0's puppet-lint ~> 5.1 requirement; 9.0.0 (released alongside the rest of the Puppet 9 tooling) depends on puppet-lint ~> 5.0 and the new puppetlabs-syntax gem instead of puppet-syntax (which never gained Puppet 9 support upstream). No special-casing needed for the puppet/facter gems themselves — Puppet 9.0.0 is now a normal release on the standard puppetcore source.
  • Rakefile: require puppetlabs-syntax instead of puppet-syntax (matches puppetlabs_spec_helper 9.0's dependency), and disable the strict_indent puppet-lint check — its expected indentation for multi-line arrays/hashes changed incompatibly between the puppet-lint major version pulled in by plugins ~> 5.0 (Puppet 8 lane, Ruby 3.1) and ~> 7.0 (Puppet 9 lane, Ruby 3.4+), so no single indentation style in these manifests satisfies both.
  • .github/workflows/{ci,nightly}.yml: default to ruby_version: "3.2" (voxpupuli-puppet-lint-plugins 7.0 requires Ruby >= 3.2). Install libcurl headers on the Spec job so puppet_litmus's bolt/patron native extension builds on the Ruby 4 lane. Add --collection-platform-exclude 9:<platform> for redhat-7/debian-10/ubuntu-18.04/ubuntu-20.04 — these platforms have no Puppet 9 agent build (nightly install 404s), so only their Puppet 9 acceptance run is dropped while Puppet 8 acceptance keeps running. Set disable_apparmor: true on the Acceptance job — AppArmor's unix-chkpwd profile denies the PAM password-check helper the capabilities it needs to read /etc/shadow inside a container, causing intermittent "Authentication failed for user root@localhost" errors on Rocky-8 even with correct credentials. Confirmed live via an interactive tmate debug session on a failing runner: the container's journal showed apparmor="DENIED" ... profile="unix-chkpwd" at the exact moment of every failure; 3/3 clean runs after disabling.
  • .github/workflows/mend.yml: default to ruby_version: "3.2" too, since bundle lock resolves all groups (including :development) at whatever ruby that job runs.
  • .sync.yml: mark ci.yml/nightly.yml unmanaged so a template sync doesn't silently drop the additional_packages/ruby_version/disable_apparmor inputs pdk-templates can't express yet.

Test plan

• bundle exec rake syntax lint metadata_lint check:symlinks check:git_ignore check:dot_underscore check:test_file rubocop — all pass (verified locally on Ruby 3.2 against the final Gemfile/Rakefile)
• bundle exec rake parallel_spec — 291 examples, 0 failures
• CI: Spec tests pass on both Puppet 8 and Puppet 9 lanes
• CI: Acceptance tests pass across platforms on both lanes, including 3 consecutive clean runs on the previously-flaky Rocky-8 platform after the AppArmor fix

MODULES-11727

🤖 Generated with Claude Code