Conservative package update

[chris-rock]

We should separate package updates from hardening. The current version updates the dependencies for apt by using and upgrades the system on RHEL

The behavior for apt and yum is slightly different and should be harmonized. I propose, we do not a yum update because this would lead to package upgrades in production environments that we may not want.

• make package upgrades optional
• stick to a specific version of apt to ensure the same behavior
• always update dependencies e.g. apt-get update
• a default rerun should not update packages

[chris-rock]

Fixed by #12
We do not fix the package versions in metadata until we get to know a specific issue.