Add (optional) call for restic self-update

The container could regularly run `restic self-update` to keep restic up to date.

I would keep the feature optional. Default on or off? to keep risks in production environments as low as possible.