Actually run "Upgrade from ISO" from a USB drive running the old version.

That's what users do, and is buggy. If one already has an up-to-date Tails USB
stick, they can "Clone and upgrade", and won't bother using an ISO image.

Still, let's keep the "Clone from ISO while running the new version" test,
as it tests the Installer in the tested (new) version of Tails, which makes
little sense wrt. what users will do when the new version is out, but may catch
bugs that will affect upgrades to N+1.
Include the syslinux binary, and its MBR, in the ISO filesystem.

This in turn allows Tails Installer to use this binary and MBR, which is
critical for avoiding problems (such as #7345) on "Upgrade from ISO".
Merge branch 'testing' into bugfix/7345-upgrade-from-iso-from-1.0-to-1.1
Update a bit the USB installation design doc.
Merge remote-tracking branch 'origin/master' into bugfix/7345-upgrade-from-iso-from-1.0-to-1.1
Design doc update: we now upgrade the MBR too.
Rephrase.
Document that newer tails-create-iuk also stores the EFI and syslinux directories in boot.tar.bz2.
Grant additional permissions needed by the tails-install-iuk user.
Update design doc wrt. upgrading syslinux+MBR after full and incremental upgrades.
We now depend on Test::BDD::Cucumber 0.16 or later.

... that is now waiting in the backports NEW queue. Likely it'll be accepted by
the time when someone running Wheezy needs to follow these steps.
Don't allow the desktop user to pass arguments to tails-upgrade-frontend (Closes: #7410)

... and accordingly update the design document and manual test suite steps.

The tails-upgrade-frontend program is run as the tails-upgrade-frontend user,
that is basically equivalent to root. Some of the available
tails-upgrade-frontend options might be dangerous. I've looked at it quickly and
didn't find anything scary, but still, it's simply not worth taking the risk of
privilege escalation, persistent root kit implementation, and so on.

Strictly speaking, this change does not really belong to
bugfix/7345-upgrade-from-iso-from-1.0-to-1.1, and could have been implemented
separately. However, this branch introduces running as root a syslinux binary
taken from the installed IUK, so it raised the flag that made me want to lock
this down a bit more.
Merge branch 'testing' into bugfix/7345-upgrade-from-iso-from-1.0-to-1.1
Add security discussion wrt. running syslinux from the upgraded system.
Merge remote-tracking branch 'origin/testing' into bugfix/7345-upgrade-from-iso-from-1.0-to-1.1
Drop painful manual run of pherkin tests: now integrated via t/10-features.t.

Oh, and the Cucumber test suite was fixed to nicely clean up loop devices
and mounts after itself :)
Make it clear that ideally, we would use the right version of tails-perl5lib when building tails-iuk.
Merge branch 'bugfix/7345-upgrade-from-iso-from-1.0-to-1.1' into testing