minimize changes with default unattended-upgrades configuration

[anarcat]

I'd like us to consider the idea that this module should do a minimal diff with a default unattended-upgrades configuration.

There are two main ways of doing so:

1. do not touch the default config at all and instead configure in a separate file
2. do rewrite the configuration but keep the existing commented out lines

We could also mix and match, for example new features like #144 could be done in a separate file completely.

What do people think here?