There's no validation here, so if you typo `dry-run` or as `dry_run` or `dryrun` it will do it for realz.

Maybe worth having two separate functions? `unattended_upgrade` and `unattended_upgrade_dry_run` or something?