automate upgrades

upgrades take up a significant chunk of time every week and distract sysadmins (or at least me) from focusing on other projects.

upgrades should be therefore automated, as much as possible.

see also legacy/trac#31239 (moved) about auomated installs and this is part of the wider "ops card questionnaire", where we answered no to a question about this, see legacy/trac#30881 (moved).

checklist:

• install needrestart everywhere, in interactive mode
• switch needrestart to automatic mode
• install unattended-upgrades everywhere
• fix major upgrades docs to disable unattended-upgrades during the upgrade run
• [ ] automate reboots see legacy/trac#33406 (moved) instead