optional "push" install/delete commands

There are a handful of use cases where it would be useful to have an opt-in "push"-style commands for having the server trigger the install and deletion of apps. For example, a trainer runs a repo of apps and media on a PirateBox that she brings with her to trainings in case the internet is slow or out. People attending the training add the local PirateBox repo and opt-in to allow the server to install apps. All of the training materials and apps are then automatically installed.

Or another use case: a mobile provider wants to use F-Droid to provision phones with a suite of apps. Their custom repo is added, and the install/delete is enabled. When the device connects to the internet for the first time, it gets the install/delete profile and acts accordingly.

This can be achieved using only signed metadata, so no need for targeting users or a dynamic server. Here's the key bits:

• signed metadata with app install/delete commands
• opt-in per-repo to allow install/delete commands
• provisioning can set up repos and settings on client