[WIP] Kernel / Bundle fixes

| Q             | A
| ------------- | ---
| Bug fix?      | yes
| New feature?  | no
| BC breaks?    | no
| Deprecations? | no
| Tests pass?   | ---
| Fixed tickets | ---
| Refs tickets  | ---
| License       | MIT
| Doc PR        | ---

This makes sure bundles are added to the kernel before they are updated. As the logic has to be placed pretty early in the execution flow, it can only use basic url checks. This also introduces a new kernel parameter called `url_secret` to make sure that only admins can cause bundles to be added to the kernel. 
I couldn't think of a better way to handle this chicken-egg problem. :chicken: :egg: 

I will need to test the installation before merging.
this is something we will all need to work to keep an eye :eyes: on as it relates to zikula org. If upgrade.php is changed, we need to figure out a way to upgrade zikula.org without running upgrade.php over and over. maybe we can build an admin controller that can run mini scripts we add or something to simplify.

in this case, I think we'll add it by hand which sounds easiest.