Allow upgrades in hedgedoc manifests

This pile of commits reworks the hedgedoc setup to:

• make the hedgedoc a system user with no login or home directory
• use a defined cache for yarn operations
• install hedgedoc to a version-specific directory
• dump database contents before upgrading to allow for version rollbacks
• create a flag file when running bin/setup
• don't run yarn build (the release tarball ships the relevant assets, so far as I can tell)

After reviewing it, the hedgedoc bin/setup script doesn't look very robust and I'm tempted to just run yarn install manually instead, because that's all it's really doing. But that means having to review the contents of the script at each upgrade, so... meh.

Related to T2941

Test Plan

tested in vagrant from:

• an install using the old layout
• an install using the new layout

Migrated from D5001 (view on Phabricator)