deployment: Activate systems only if necessary.

So far, every "nixops deploy" always runs the activation script on all
systems, no matter if there are any changes.

We are now checking the symlink to the system profile if the canonical
path is the same as the new toplevel.

This also changes the order of send_keys() to be run after setting the
system profile, which I think should have no implication whatsoever
(system is already built and setting the profile is more-or-less just
updating symlinks).

If someone wants to force activation no matter if there are changes,
there is a new flag to "nixops deploy" called --always-activate, which
implements the previous behaviour.

Activation is always enforced on rollback.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>
Control activation behavior per machine.

This changes the default to enforce activation of the configuration,
unless you set "deployment.alwaysActivate" to false on a specific
machine.

Of course the --always-activate switch still has the same meaning as
before, so you can even enforce activation on machines that have
alwaysActivate set to false.

Signed-off-by: aszlig <aszlig@redmoonstudios.org>