Add task to run unattended-upgrades

The task always runs unattended-upgrade in debug mode. By default it
runs with the --dry-run flag. This is only removed if 'no' is passed as
an argument.