Be smarter about running integration commands

Currently all integration commands run when building every module. This is often unnecessary. E.g. there is no value in running 'update-ca-certificates' except right after building the ca-certificates package. @tristanvb suggests we need domains for integration commands to know when it's necessary. Build integration or runtime integration has different requirements. If we split it, Tristan thinks we could cut the time required by ~80%.