scripts and tools: Upgrade gitian image before signing #15766

The package upgrade in the Ubuntu repositories in the period between the building and the signing causes (particularly, using LXC) an error:

Creating package manifest
Could not download some packages, please run gbuild --upgrade

For example, the busybox-initramfs package was upgraded from 1:1.27.2-2ubuntu3.1 to 1:1.27.2-2ubuntu3.2 on 2019-03-06.

This PR forces gitian image upgrade for the --sign command.

Ref: devrandom/gitian-builder/target-bin/grab-packages.sh

#!/bin/sh

# Get an installed package manifest

set -e

cd /var/cache/apt/archives

# make sure all packages with installed versions are downloaded
# (except for held packages, which may not be available for download)
dpkg-query -W -f '${Status}\t${Package}=${Version}\n' | grep -v ^hold | cut -f2- | xargs -n 50 apt-get install -q --reinstall -y -d > /tmp/download.log
grep "cannot be downloaded" /tmp/download.log && { echo Could not download some packages, please run gbuild --upgrade 1>&2 ; exit 1 ; }
sha256sum *.deb | sort --key 2

It's unfortunate that this is needed, as the upgrade step makes VM setup much slower, but I think it is, I've seen similar issues outside this script utACK beda0dae953aa125e08302713d2c7b214eddbe5a

@laanwj Thank you for your review.

It's unfortunate that this is needed, as the upgrade step makes VM setup much slower, but I think it is, I've seen similar issues outside this script

Since the current target image is reused (-i|--skip-image option), the upgrade step does not take much time (a dozen of seconds on my Core i3).

@ken2812221 would you mind reviewing this PR?

utACK beda0da