Only allow "update" role in node state "ready"
Renaming fixes
Implement one-shot proposal

After the first chef-client run, the proposal deactivates itself. This
should make it obvious for the user that he has to apply it again for
the next update run. Also the proposal removes the "updater" role from
all node's "crowbar-$FQDN" roles so that chef-client doesn't invoke the
recipe again. Both things are done in a new callback for Crowbar's
ServiceObject base class.

Named parts actually work except that ServiceObject#apply_role doesn't
seem to really invoke chef-client despite looking like it would...