We're trying to reduce the odd software we run, and now apt itself is
quite capable of doing such detections on its own.

This was kind of scattered all over the place and not directly linked
from the (most usual) Ganeti procedure. Now we have the procedure all
in one shot, and with the fat warning about the most common error I've
done twice already.

Used with success in team#41258.

unsure currently if this affects all bookworm upgrades, but if it looks
like it, we should add this to the main upgrade procedure.

What we've discovered (with @lavamind) is that the token
policy *restricts* the user policy, so we actually need both. We
selected to do a bucket per service, and a token restricted to the
bucket.

The reboot actually takes care of this, but we often wait on this
while we look around, and having the `nologin` file around makes some
things (like sshdist on alberti) explode.

based on comparing these docs with the actual policy implemented in our
instance of minio, which includes a policy not discussed here which is
`arn:aws:s3:::gitlab*`: this policy seems sufficient to *also* grant
access to all objects in "gitlab*" buckets but I could not confirm this
anywhere in either the MiniO or Amazon documentation, which is why below
I'm explicitely adding resources definitions with the `/*` suffix to the
policy examples

for sure the `arn:aws:s3:::gitlab` resource does not allow creating any
bucket other than one named "gitlab"

Closes: team#41296

This will typically be `grml` if we're booted in there and haven't
changed the hostname yet, but that's better than a hardcoded
`fsn-node-04`.