The script now prompts the user to choose between enabling all updates
or limiting to security-only updates via unattended-upgrades. This
choice is respected in the Origins-Pattern configuration, making the
script more flexible for different update policies. Non-interactive
runs default to all updates. Support for UPDATE_SCOPE env var added.
