Run "apt-get update" outside of/before puppet

Currently, we run "apt-get update" on every puppet run, in a separate
"first" Stage, with the effect of running it before everything else that
may need up-to-date package lists (= Package resources for the most
part).

This has the following problems:
- Transient apt-get failures (e.g. mirror issues) produce puppet
  failures and we get an alert for every single host
- Puppet runs consume more time, something that's especially annoying
  during manual puppet runs
- Changing apt's configuration (with apt::repository etc.) doesn't
  trigger an additional apt-get update, as you can't run the same
  resource twice (and because of Stages, it's tricky to be implemented
  correctly because of dependency loops, see e.g. a14a2e3)

The above aren't unfixable but instead of taking a stab at fixing them,
move the "apt-get update" invocation to the cronjob we have for running
puppet. The script runs with -e, so a failed apt-get update would stop
puppet from running (similar to today), but would not warn us until
sufficient time has passed and the "hasn't run puppet for X seconds"
check fires off.

Moreover, instead of dropping the Exec, move it to the main apt class
(and to the main Stage), make it a refreshonly and add notifies from all
of the apt definitions.

Change-Id: I4ae2b64d096d38b3eeeda2791949274fb1f69ffa
Merge "Run "apt-get update" outside of/before puppet" into production