Support upgrading base upstream image.

[zfouts]

This will ensure latest available security patches are applied on each build. Some upstream images take months to be updated.

[QuantumEntangledAndy]

Sure we can add that, I mostly avoided it for keeping build time low during testing