install: policy for enabling systemd services and enabling new versions after updates

[stapelberg]

Currently, when installing a new package, any systemd services which that package contains are not automatically enabled. We should offer a knob to make it so.

Also, when updating a package to a newer version, the old version remains enabled in systemd. This is because systemctl enable resolves symlinks to their target, so we end up with e.g.:

/etc/systemd/system/ssh.service -> /usr/lib/systemd/system/../../../openssh-amd64-8.2p1-11/out/lib/systemd/system/ssh.service

Handling symbolic links at all was only added in https://github.com/systemd/systemd/pull/3790, a bunch of places in systemd use O_NOFOLLOW and patching the behavior to link /etc/systemd/system/ssh.service -> /ro/lib/systemd/system/ssh.service seems non-trivial.

This situation is easy to rectify manually (systemctl disable ssh; systemctl enable ssh), but laborious and easy to forget.