internal.py: add global config key 'unlock_on_failure'

When testing new tasks, it's a drag to have to keep manually unlocking
the targets.  Default behavior is to keep them locked for any failure;
this allows overriding that choice for the case where the failure is
in debugging the task, where the state of the targets isn't important.

Signed-off-by: Dan Mick <dan.mick@inktank.com>
calamari.sample.yaml: pkgdir for two of the three tasks,
roles for -restapi and -agent

Signed-off-by: Dan Mick <dan.mick@inktank.com>
calamari-restapi: first cut at try/finally, new _utils, etc.

Signed-off-by: Dan Mick <dan.mick@inktank.com>