Using puppet and ensure latest for RPM package management

Puppet (I'm pretty sure chef does also) ties in with your apt-get/yum software repositories. Since they do the heavy lifting of figuring out which packages are available, that means ensure => latest just works for Ubuntu/CentOS/Debian the like. As long as you set up the appropriate files correctly (/etc/apt/sources.list, etc).

Is this just a windows limitation?

The MSI provider seems pretty limited relative to the other package providers. This certainly isn't a limitation of Windows/MSI. I believe Windows provides what is needed to make those options work.

Is there a way to upgrade the existing Java install using msi packages?

One option might be to give up on the package msi provider and simply do it all with Exec statements. The msiexec command has lots of options.

You could probably also come up with a way of arranging things so that if an upgrade needs to be done, the old version is purged first. Then a new version is installed, you would probably have to keep track of the version in a file or the registry somewhere, since the MSI providers doesn't give you any information about the version.