deployment: Activate systems only if necessary.

So far, every `nixops deploy` always runs the activation script on all systems, no matter if there are any changes.

We are now checking the symlink to the system profile if the canonical path is the same as the new toplevel.

This also changes the order of send_keys() to be run after setting the system profile, which I think should have no implication whatsoever (system is already built and setting the profile is more-or-less just updating symlinks).

If someone wants to force activation no matter if there are changes, there is a new flag to "nixops deploy" called `--always-activate`, which implements the previous behaviour.

Activation is always enforced on rollback.