Restrict sudo access, extract addon bins

This adds an option to restrict sudo access for the travis user as
follows:

* Removes all group permissions from /etc/sudoers, so travis does not
  have sudo access through the sudo group it is a member of on normal
  images.

* Replaces the current /etc/sudoers.d/travis file with:

   `travis ALL=(ALL) NOPASSWD: /usr/local/travis/bin/*`

  I.e. the travis user will have access to all files in that directory.

* Extracts bash code from the firefox, hosts and postgresql addons to
  bins in /usr/local/travis/bin. These are the only addons that use
  sudo.

* Adds a wrapper script for the `service` command to the same bin dir
  and makes the service command use it.

Also fixes the hosts addon bash code to work on both Linux and Mac OS X.