deployment: Activate systems only if necessary.

So far, every "nixops deploy" always runs the activation script on all
systems, no matter if there are any changes.

We are now checking the symlink to the system profile if the canonical
path is the same as the new toplevel.

This also changes the order of send_keys() to be run after setting the
system profile, which I think should have no implication whatsoever
(system is already built and setting the profile is more-or-less just
updating symlinks).

If someone wants to force activation no matter if there are changes,
there is a new flag to "nixops deploy" called --always-activate, which
implements the previous behaviour.

Activation is always enforced on rollback.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>