automate upgrades

upgrades take up a significant chunk of time every week and distract sysadmins (or at least me) from focusing on other projects.

upgrades should be therefore automated, as much as possible.

see also #31239 (moved) about auomated installs and this is part of the wider "ops card questionnaire", where we answered no to a question about this, see #30881 (moved).

checklist:

• install needrestart everywhere, in interactive mode
• switch needrestart to automatic mode
• install unattended-upgrades everywhere
• fix major upgrades docs to disable unattended-upgrades during the upgrade run
• [ ] automate reboots see #33406 (moved) instead