upgrade our needrestart package to 3.8

In #41881 (closed) we mitigated a serious security issue in needrestart, by turning off the "bad" code in the configuration. That's not a good enough fix, we need to update our version of the package (which is essentially a fork of the Debian package).

I've collaborated with the Debian package maintainer in the past so I have asked how to proceed to go forward (whether we try to ship 3.8 or patch the 3.7-3.1, i favor the former).