Run apt update in cloud-init

[strugee]

We do this in Ansible too... except that, when a host is first provisioned, it has an empty APT cache. This isn't a huge deal but it makes for a super confusing error message when you go to add the host to Ansible in GitHub Actions, which you have to do because GitHub Actions holds the only bootstrap SSH key.