automatic upgrades on image creation, enable unattended upgrades daily

I'm wondering if we should move to the convention of using name instead of pkg, and using `{{ item}}` and `with_items: {{ security_debian_pkgs }}`