Fix repository duplication and add package auth

Previous iterations of the preseed template disabled package auth
for the Cisco repo because the debian installer poorly supports
fetching a key through a proxy when performing a preseeded install.
Additionally, the previous template added the repo via d-i commands
in preseed which resulted in a duplicate repository definition
after the first Puppet catalog run due to Puppet setting up the
repo in /etc/apt/sources.list.d and d-i adding it in
/etc/apt/sources.list.  This patch resolves both issues by moving
the entire repository setup process into late_command and
specifying the key locally.  An trivial additional patch to
puppet-coi to prevent puppet from being installed before
late_command is run will be needed to fully resolve the bug.

Partial-Bug: #1265850