Add configuration options to filter facts out in OpenVoxDB termini

[djuarezg]

Summary

Add two puppetdb.conf settings for excluding facts before they are submitted to OpenVoxDB:

• fact_names_blocklist matches exact dot-separated fact paths.
• fact_names_blocklist_regex matches complete fact paths using Ruby regular expressions.

The filtering supports nested hashes and hashes inside arrays. It rebuilds structured values instead of modifying Puppet-owned facts in place.

Motivation

The existing server-side facts-blocklist setting cannot selectively remove keys from structured facts.

This implements the behavior originally proposed in puppetlabs/puppetdb#4021, which is unlikely to be merged now that the upstream repository is inactive.

Example

[main]
fact_names_blocklist = secret, networking.interfaces.eth0.mac
fact_names_blocklist_regex = (^|\.)password$

This removes:

• The complete top-level secret fact.
• Only networking.interfaces.eth0.mac from the structured networking fact.
• Any key named password, including keys inside hashes contained in arrays.

Invalid regular expressions are rejected when puppetdb.conf is loaded.

We have been using at CERN this as a patch for quite some time already and it covers our use cases such as blocking podman interfaces polluting OpenvoxDB:

cernpuppet::puppetdb::fact_names_blacklist_regex:
  - ^blockdevice_
  - ^db_
  # Migrating the filtering from https://github.com/cernops/facter/commit/6f7648b73dfe9fd35b9769eec0ac6053645d493a
  - ^networking.interfaces.*nic.*
  - ^networking.interfaces.*tap.*
  - ^networking.interfaces.veth.*