Fix for bucket_path security vulnerability

This is a fix for Bugs #13553, #13418, #13511. The bucket_path parameter
allowed control over where the filebucket will try to read and write to.
The only place available to stop this parameter is in the resolution
from a URI to an indirectory terminus. The bucket_path is used
internally for local filebuckets and so cannot be removed completely
without a larger change to the design.

Conflicts:

lib/puppet/network/http/api/v1.rb
spec/unit/network/http/api/v1_spec.rb

Conflicts resolved by modifying the patch to fit the use of
Puppet::Indirector::Request in the code.