Add 'needs-reboot' restriction

This allows tests to be explicit about needing to reboot the machine,
rather than assuming that 'isolation-machine' is enough. It is plumbed
into the existing 'reboot' capability, which is distinct from
'isolation-machine'.

Closes: #842300

Modified by Martin Pitt: Add tests