Upgrade Puppet agents to Puppet 4
Originally created by @intrigeri on #11838 (Redmine)
Upstream doc: https://docs.puppet.com/puppet/4.5/reference/upgrade_major_agent.html
Note that the Puppet 4 master in Stretch is supposed to be able to handle 3.8.x agents. So we can do that incrementally.
Parent Task: tails/sysadmin#11834