Require an explicit command to upgrade the db

Adds a "gpgpwd upgrade" command that replaces the old automatic
database format upgrades.
Removed --force-unsafe

gpgpwd should not help someone shoot themselves in the foot.
Removed the global requireAgent variable