First pass at a safe restart required for doing major upgrades in chef

The new handler gets called *only* on a successful chef run. The restart handler looks for the file /var/run/reboot-required, which is used by apt to signal a reboot is needed (thats what motd uses). 

This PR isn't actually finished but I want others thoughts on this way of dealing with the whole restart thing.

Note this is only any good if you are scheduling chef runs over your clusters. If your letting chef do it... badness could happen, so set ago_restarts=false

I would like to add some things to the handler, like "termination policy", (evac host or terminate vms), also setting ceph no out. But this is an opening shot.