feat: firstrun improvements

- add fact to detect firstrun
- run a limited subset of classes on firstrun
- firstrun: includes:
  - vault ca certificates
  - yum/apt repositories
  - fast-install packages with an exec

modules/libs/lib/facter/firstrun.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+Facter.add(:firstrun) do
+  confine kernel: 'Linux'
+  setcode do
+    File.exist?('/root/.cache/puppet_firstrun_complete') ? false : true
+  end
+end