1.3.3

Update in the background, with permission asked once

The client now installs new versions on its own when allowed to: it sees
the release, says it is updating, downloads, restarts and brings the
connection back to the same server and the same mode - even when
"connect on start" is off, because the person asked to update, not to be
left without a tunnel. Permission is asked once, on the first run of a
new version, and lives as a switch in the simple settings afterwards.

Pressing Update in the card no longer asks the same thing twice more.

Two fixes found while testing this on a real update:

- On macOS the updater replaces the whole .app, and the settings live
  inside it by default, so an update wiped every subscription. Move the
  config out of the bundle before handing over to the updater, to the
  same place the client falls back to when its folder is read-only.
- Our dialogs put the heading in the window title as well, so a question
  read twice in a row. The title is the program name now.