Handle special YES/NO values for service flags

Certain rc.conf(8) variables configurable via rcctl(8) do not correspond
to services;  en/disabled ones report YES/NO as flags value, which is an
implementation detail and thus cannot work as daemon flags:

```
$ rcctl get multicast
multicast=NO
$ rcctl get pf flags
YES
# rcctl set pf flags foo
rcctl: "pf" is a special variable, cannot "set flags"
```

Actual services may have default flags set in their `/etc/rc.d/*` scripts,
but also report NO unless they are enabled:

```
$ rcctl get    rarpd status ; echo $?
1
$ rcctl get    rarpd flags
NO
$ rcctl getdef rarpd flags
-a
```

Turn those into `nil` for puppet-resource(8) to yield proper flags:

```
 $ puppet resource service pf
 service { 'pf':
   ensure   => 'stopped',
   enable   => 'true',
-  flags    => 'YES',
   provider => 'openbsd',
 }

 $ puppet resource service rarpd
 service { 'rarpd':
   ensure   => 'stopped',
   enable   => 'false',
-  flags    => 'NO',
   provider => 'openbsd',
 }
```

Author: klemensn

lib/puppet/provider/service/openbsd.rb

@@ -57,13 +57,12 @@ def running?
     true if output =~ /\(ok\)/
   end
 
-  # Uses the wrapper to prevent failure when the service is not running;
-  # rcctl(8) return non-zero in that case.
+  # Disabled services always have 'NO' flags.
   def flags
     output = execute([command(:rcctl), "get", @resource[:name], "flags"],
                      :failonfail => false, :combine => false, :squelch => false).chomp
     debug("Flags are: \"#{output}\"")
-    output
+    output unless %w[YES NO].include?(output)
   end
 
   def flags=(value)