VM's: run first-boot units without debconf dialogs

[MickLesk]

A first-boot script that runs apt (Waydroid, NetBird's Docker install) let needrestart draw its "Pending kernel upgrade" dialog on the serial console; whiptail then failed with "Failed to open terminal" and Perl warnings. The generated unit now carries Environment=DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a NEEDRESTART_SUSPEND=1, so this holds for every first-boot script without each having to set it.

Covered in tests/vm-helpers.sh; the unit passes systemd-analyze verify.

[github-actions]

Try this branch

The engine and the scripts resolve independently, so a production script can
be run against the engine from this PR by setting one variable:

COMMUNITY_SCRIPTS_CORE_URL=https://raw.githubusercontent.com/community-scripts/core/fix/firstboot-noninteractive \
bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/debian.sh)"

Swap ct/debian.sh for whatever exercises the change.

Run a script from a fork as well

curl -fsSL https://raw.githubusercontent.com/community-scripts/core/fix/firstboot-noninteractive/tools/run.sh |
  bash -s -- https://raw.githubusercontent.com/YOU/DevScripts/your-branch ct/debian.sh \
             https://raw.githubusercontent.com/community-scripts/core/fix/firstboot-noninteractive

Note that run.sh is reached through a pipe, so the script it starts inherits
an exhausted stdin. Whiptail is fine — it opens /dev/tty — but a plain read
would see EOF. The single-variable form above does not have that problem.

Useful flags while testing

dev_mode=net logs every engine fetch with status and duration, which is the
quickest way to confirm the branch is really being used. dev_mode=keep stops a
failed build from deleting the container along with the evidence.