ansible/library/edeploy: make the upgrade sub-command idempotent
metadata/D7-H.1.0.0/openstack-full/D7-H.1.1.0/exclude: exclude /var/lib/puppet/ssl as a whole