Add support for client binary on upgrade

Went ahead and implemented this, looking for feedback, how do those file permissions look to you?

ping @SvenDowideit @tianon 
1. No, so inlining it as a literal might be preferable
2. Mostly because I didn't know that `https://get.docker.io/latest` is a thing.  Is that definitely going to be supported in the future?