[WIP] Kernel / Bundle fixes

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | ---
| Fixed tickets | ---
| Refs tickets  | ---
| License       | MIT
| Doc PR        | ---

This makes sure bundles are added to the kernel before they are updated. As the logic has to be placed pretty early in the execution flow, it can only use basic url checks. This also introduces a new kernel parameter called `url_secret` to make sure that only admins can cause bundles to be added to the kernel. 
I couldn't think of a better way to handle this chicken-egg problem. :chicken: :egg: 

I will need to test the installation before merging.
Could run the upgrade routines from the console if the actual upgrade stuff is refactored out of the upgrade.php so it is just the UI.