upgrades: Add diagnostic repair for held packages

If the freedombox package has a hold due to app install, manual update, or dist-upgrade, then a flag is placed at /var/lib/freedombox/package-held. This flag is checked, and the hold could be removed, when starting any of these operations.

We should also check for this flag periodically, in case it was left by an interrupted process. As long as there is no dpkg/apt/upgrade process running, then it is safe to release the hold and remove the flag.

Update

As discussed in a progress call, we will let FreedomBox manage all package holds.

• Add diagnostic to check for held packages. Skip the diagnostic if a package install is running, or if the freedombox-dist-upgrade service is running.
• Add a repair step for the diagnostic to release any package holds.
• Currently, _release_held_freedombox() is only checking if package manager is busy. Consider checking instead if a package install is running, or if the freedombox-dist-upgrade service is running.
• Change apt_hold_freedombox() to unhold the package at the end, regardless of previous hold.
• Change apt_hold(packages) to unhold the packages at the end, regardless of previous holds.
• Consider if the /var/lib/freedombox/package-held flag is still needed. If it is kept, then add a diagnostic to check for it.