feat: add paranoid mode

This is useful for when the build script runs on a machine where it
can't be trusted with elevated privileges.
Don't run services when paranoid mode is enabled

Most services require sudo, so disabling them alltogether is the easiest
for now.
Don't run addons in paranoid mode
paranoid-mode: add a message explaining what is disabled
rename the config option to :paranoid

align this with https://github.com/travis-ci/travis-worker/commit/cf0d2464fff8eb4ccfa3971ec229bd4e72c8ab89#diff-d2601e3857d12659bfc7e6717e90424dL65
paranoid-mode: use find to remove setuid permissions
Run `export`s after enabling paranoid mode

One could set up an environment that executes code using $() or ``,
which might use sudo, so the exports should go after paranoid mode is
enabled (if it isn't enabled it doesn't matter what order it goes in).

This also extracts most of the "builtin" stages into a separate
configure stage instead.
remove fix_ssl, and add a switch for updating host info
change from skip_hosts_updates to skip_etc_hosts_fix
Merge branch 'master' into hh-paranoid-mode
Merge branch 'master' into hh-paranoid-mode

Conflicts:
	lib/travis/build/script.rb
add a spec for skipping fixing the etc/hosts file
add some simple tests for paranoid mode
oops, should be ‘paranoid’
fix the spec?
another fix as i missed another set of ‘s
nest the paranoid specs and add a note
remove the extra slash
Merge pull request #230 from travis-ci/hh-paranoid-mode

feat: add paranoid mode