only install needrestart from backports; pin server-scripts commit