Use aptitude safe-upgrade for apt upgrade=yes

Use aptitude safe-upgrade instead of apt-get upgrade to implement
apt: upgrade=yes. Using aptitude ensures that missing dependencies
will also be installed.

Fixes #2540
upgrade should obey check mode
Merge pull request #2541 from lorin/apt-upgrade

Use aptitude safe-upgrade for apt upgrade=yes