apply task only if dependency task is applied

[ryane]

Currently, a task can depend on another task. However, there are some situations where you only want the dependent task to apply if the apply step of the previous task ran. Some examples:

• running a command (generating a certificate, for example) only if a file was created or modified (from a file.content resource)
• running apt-get update only if a new repo was added (we don't want it to run if the repo was already in place)
• setting file mode on files only if they were just extracted from a tar file

some of the above examples can be handled in higher level resources but this seems to be a common enough use case that we should consider having this capability.

[rebeccaskinner]

what about something like:

switch "when-run" {
  case "{{file.content.resource.willchange}}" {
    // do the things
  }
}

There are some limited cases where this already sort of works but it's a quirk of implementation rather than an intentional feature at this point. It should be easy to make it work more reliably after we have finished #374