feat: firstrun improvements

- add fact to detect firstrun
- run a limited subset of classes on firstrun
- firstrun: includes:
  - vault ca certificates
  - yum/apt repositories
  - fast-install packages with an exec

site/profiles/manifests/firstrun/packages.pp

@@ -0,0 +1,27 @@
+# profiles::firstrun::packages
+class profiles::firstrun::packages {
+  # include the correct package repositories, define the install_packages exec
+  case $facts['os']['family'] {
+    'RedHat': {
+      include profiles::yum::global
+      $install_command = 'dnf install -y'
+    }
+    'Debian': {
+      include profiles::apt::global
+      $install_command = 'apt-get install -y'
+    }
+    default: {
+      fail("Unsupported OS family ${facts['os']['family']}")
+    }
+  }
+
+  # get all the packages to install, and convert into a space separated list
+  $packages = hiera_array('profiles::packages::install', [])
+  $package_list = $packages.join(' ')
+
+  # install all the packages
+  exec { 'install_packages':
+    command => "${install_command} ${package_list}",
+    path    => ['/bin', '/usr/bin'],
+  }
+}