deploys a daily cronjob to update packages.
populates a versionlock for packages using either apt_preferences role or yum versionlock plugin
fully untested ! the purpose of this draft is to have a baseline for discussion
upgrade role can be further simplified
upgrade role currently wipes the settings of unnatended-upgrade. We could rerun unattended upgrades using the same tag or try a different mechanism.