Upgrade Puppet on initial up

We need 3.7 for some new stuff. This is annoying, but unavoidable.
Update apt submodule
Use apt::hold to hold versions in place

This stops updates from saying "changed from 5.3.* to 5.3.2-...", and
uses apt's native systems a little bit better.
Workaround for downgrading from 5.5 to 5.3
Use @var instead of var in erb templates
Merge branch 'master' into pin-packages
Make best-effort attempt to match version

As it turns out, this likely won't work, but we'll try anyway. APT
packages "expire" once new ones are released, so using a specific PHP
version here is likely to break.

We'll handle this some other time, but for now, let's do our best at
setting the policy.
Merge pull request #109 from Chassis/pin-packages

Pin packages