[Matthias schiffer: rebase, add a few more restrictions]

Some files have received some additional refactoring.

The generic upgrade script is moved to run after the more specific scripts.
In addition, the script will now remove the configuration sections of
uninstalled VPN packages, so both positive and negative changes of the
default enable state can be migrated correctly.

Based-on-patch-by: Cyrus Fox <cyrus@lambdacore.de>
Fixes: #1187

VPN daemons were always disabled

Based-on-patch-by: Cyrus Fox <cyrus@lambdacore.de>

The fastd_mesh_vpn site.conf section is renamed to mesh_vpn.fastd.