rsyslog configuration worker

[Ian Booth]

> 
> It doesn't necessarily have to be a worker, just something that runs once
> at machine agent startup: wait for environ config, write rsyslog config,
> restart rsyslog.
> 

That's actually how the upgrade happens now - the machine agent is the process
which invokes the upgrade operations with a context containing a state API
connection ie the upgrades are only run once a state server worker is running
and the API (and hence environment) is available. So we could do whatever
rsyslog config changes are needed to support TLS as part of the standard upgrade
process. Unless I'm misunderstanding something.