The grml-debootstrap install process properly sets up sources.list
with security upgrades, and we should expect the same of any install
process.

That's a pre-requisite of the new-machine setup, which we failed to
fulfill.

Instead we'll copy authorized keys in a hook ourselves.

This is so we have one less thing to do by hand in the installer.

We need to copy this into the password manager so it *needs* to be
obvious here.

Normally, the --defaultinterfaces command *should* setup a proper file
for us, including automatic config for eth0. Let's see if it works
next time.

tsa-misc is not exactly a pre-requisite: none of the installers
currently deploy it, and it might eventually go away if we go the
"remote bootstrap" way.

tmpfs and swap are correctly setup on ganeti and hetzner cloud, so we
don't need them in the common trunk.

This is mostly so that we know how to design the previous installers.

 * nagios goes first so we get less warnings during decom
 * backups are almost last
 * inventory is last, except for unracking
 * dnswl entry is earlier

I am aware this will break references from checklist in trac tickets,
but i think that's a less evil. Besides we can still refer to those
through the history as needed.