feat: add paranoid mode

This is useful for when the build script runs on a machine where it
can't be trusted with elevated privileges.
Don't run services when paranoid mode is enabled

Most services require sudo, so disabling them alltogether is the easiest
for now.
Don't run addons in paranoid mode
paranoid-mode: add a message explaining what is disabled
rename the config option to :paranoid

align this with https://github.com/travis-ci/travis-worker/commit/cf0d2464fff8eb4ccfa3971ec229bd4e72c8ab89#diff-d2601e3857d12659bfc7e6717e90424dL65
paranoid-mode: use find to remove setuid permissions
Run `export`s after enabling paranoid mode

One could set up an environment that executes code using $() or ``,
which might use sudo, so the exports should go after paranoid mode is
enabled (if it isn't enabled it doesn't matter what order it goes in).

This also extracts most of the "builtin" stages into a separate
configure stage instead.
remove fix_ssl, and add a switch for updating host info
change from skip_hosts_updates to skip_etc_hosts_fix
Merge branch 'master' into hh-paranoid-mode
Set TERM to 'dumb' for JVM builds
Merge pull request #240 from travis-ci/ha-gh-travis-ci-2275

Set TERM to 'dumb' for JVM builds
Merge branch 'master' into hh-paranoid-mode

Conflicts:
	lib/travis/build/script.rb
Set TERM to 'dumb' when Gradle config is detected

There are following issues with #240 (dfe2bfc):

- Android builder does not export TERM=dumb (common parts are in jdk.rb,
  not jvm.rb)
- TERM=dumb would be exported for all JVM languages, even if not built
  with Gradle.
Merge pull request #241 from travis-ci/gh-2275-gradle-change

Set TERM to 'dumb' when Gradle config is detected
add a spec for skipping fixing the etc/hosts file
add some simple tests for paranoid mode
oops, should be ‘paranoid’
fix the spec?
another fix as i missed another set of ‘s