deploy dynamic environments on the Puppet server

We should be able to push to a new branch and have that be a specific environment that can be ran only on a subset of machines.

I've done something like this in my home lab: code in /etc/puppet/code/production is the default, but i can make new ones (currently by hand) in /etc/puppet/code/BRANCHNAME. It's pretty useful to avoid "YOLO" commits that plague our history, but can also be used for more sensitive deployments.

This probably depends on first creating a role account (#29663 (closed)) and goes along validation checks (#31226). It could probably be done without any of those though...