playbook: debian{9,10}: Track distro kernel updates

See merge request nexedi/slapos.package!133

playbook/roles/vifib-kernel/tasks/main.yml

 ---
 
-  - name: Install Debian stable-proposed-updates repository
-    apt_repository: repo='deb http://deb.debian.org/debian/ oldstable-proposed-updates main' state=present update_cache=yes
-    when: ansible_distribution == "Debian" and ansible_distribution_major_version == "9"
-
-  - name: Install kernel 4.9 on debian 9.0
-    apt: name=linux-image-4.9.0-13-amd64  state=latest default_release=oldstable-proposed-updates update_cache=no
-    when: ansible_distribution == "Debian" and ansible_distribution_major_version == "9"
+  # Debian 9/10: install latest kernel stable updates provided by the distribution.
+  # - good for security
+  # - needed to keep in sync, with nxd-fuse-dkms which through dkms installs
+  #   latest linux-headers-amd64. If those headers won't match installed
+  #   kernel, nxd-fuse will be skipped to compile, fail to load and FUSE won't
+  #   be working at all:
+  #   https://lab.nexedi.com/nexedi/slapos.package/merge_requests/132#note_120438
+  - name: Debian 9/10 - Install latest stable updates for distribution kernel
+    apt: name=linux-image-amd64  state=latest update_cache=yes
+    when: ansible_distribution == "Debian" and
+          (ansible_distribution_major_version == "9" or ansible_distribution_major_version == "10")
     notify: [ 'Mark to reboot' ]
 
   - name: Install Debian jessie-backports repository