Shores up update cron logic

[conorsch]

Still using bash, but pared down the qubesctl calls to what's strictly necessary. Also replaced pkg.upgrade with the Qubes-maintained "update.qubes-vm" Salt state, which intelligently handles Debian/Fedora VMs. It first applies critical patches, such as for DSA-4371-1/CVE-2019-3462, for patching apt, then ensures all packages are up to date.

Ideally we'd leverage the Admin API here, but to aid in review, let's fix the most egregious problems, and go from there.

The major reduction in run time due to these changes is that only the SDW Template VMs are updated, whereas the previous logic used --templates to update all TemplateVMs on the host system.

Closes #339.

Testing

make clone
make prep-salt
sudo qubesctl --show-output state.sls sd-dom0-files
time sudo securedrop-update

Confirm no errors, and a reasonable runtime. On my system (T480), the run took ~6m.

[kushaldas]

Worked as suggested.