Move bulk of /usr/bin/criticctl to maintenance/criticctl.py

The part left is essentially that which depends on installation data,
and enough to make it possible to pull in maintenance/criticctl.py and
call the code in it.

Since templates are essentially large Python format strings, they are
cumbersome and error-prone to work with in the long run, and it makes
sense to keep them as small and simple as possible.
Call setgid('critic') in criticctl (already called setuid('critic'))

If /etc/critic is owned by root.critic, and not accessible to others, and
criticctl is called by root.root, which then setuid's to critic, and is
effectively critic.root, then /etc/critic is inaccessible to criticctl.

And running as critic.critic is the ideal anyway.

(Here, "critic" is the user/group that Critic was installed to run as.)
Add basic criticctl tests