Comment 29 for bug 1928674

Although amd64 cloud images don't fail to boot after the upgrade, we've determined that the same fundamental problem - that the contents of the removable path are not updated on grub upgrade - also affects amd64/xenial. This means that all xenial cloud images, whether the update is installed or not, will not be *booting* the binary that has the security fixes.

So we need to fix this for both amd64 and arm64 in xenial by having it --force-extra-removable unconditionally on upgrade.