Flexible catalog compilation

Puppet Server currently only has one endpoint for requesting a catalog. This endpoint requires that the requester be requesting their own catalog, i.e. that the name on cert used to authenticate the request match the name of the node for which the catalog is being compiled. It also does not allow the caller to specify what happens with reports or facts.

As we expand our portfolio, the need has arisen for an endpoint that allows requesting catalogs for other nodes. For example, CD4PE needs to request catalogs for arbitrary node names as part of Impact Analysis, and managing network devices requires a "proxy agent" to make catalog requests on the behalf of the devices being managed.

We want to create a new catalog endpoint that allows certain entities to request catalogs for arbitrary nodes. In the case of CD4PE, this would probably be controlled via an RBAC permission (see PE-25566), which for device management it would be locked down to the proxy agent's cert.

In order to service both of these use cases, this endpoint needs to be able to control whether or not reports and facts are saved to PuppetDB (CD4PE does not want this, Network Automation does), and under what name to save them. It also needs the ability to allow environments to be specified as part of the request, as an alternative to going through the classifier.

This endpoint might also enable us to create a CLI tool satisfying PUP-9055, that calls this endpoint on the backend.