puppetmaster: Add script to track upstream changes

This is currently in use by deployment-prep, and seems general
enough for wider use as is. Adds a puppetvar that makes this
usable.

Note that before merging must munge the roles applied on
deployment-salt.

Bug: T1150
Change-Id: Ifa3229d6fb3424f75d14dd2569efca3b93936aeb