remove 4.13 kernels from new nfs servers

We continue to observe fsnotify related lockups in new nfs servers. This issue is to track the removal of 4.13 kernels from them.

• remove 4.13 kernels
• create runbook on how to do it

In the future, we should return to investigating building os images with packer or equivalent, as the whole reason that our 4.11 pin is not working is just:

• box created by cloud provider, having linux-{azure,gcp} metapackage installed
• dpkg installs latest linux-image-4.13-* as a dependency of the aforementioned metapackage
• after provisioning, chef starts and installs pinned 4.11, which never get booted because 11<13.

Since we decided not to pin 4.11 in grub (that turned out to be too hacky), and we're not removing kernels with chef (that could be too dangerous if glob matches are implemented incorrectly), the solution is just to remove 4.13 and the metapackage, which should be done at least once per node lifecycle (likely exactly once).