Upgrade the currently installed container image

[almet]

When a new image is released on the container registry, we should be able to detect it, verify its signature against a locally known public key and install it.

We currently have a mechanism in place to detect new dangerzone versions (not container images), and this should probably be an extension of it.

When installing a new image, we should also delete the old one, to save space

Open questions:

• Should we have a specific setting to allow container image updates in-place, or should we rely on the fact that the user has allowed checking for updates?