akanda-rug does not have a root helper

Our default config sets root_helper to 'sudo', meaning the rug service has wide open sudo access. While its not the best, the rootwrap approach is the standard way of providing finer grained sudo access to openstack service daemons. Lets implement it in the rug and have a default rootwrap filters that allows only the commands the RUG needs. This'll require a quick audit of current sudo usage to figure out what we need to allow.