Enforce latest kernel selection for instances running 3.14.x series

[eloquence]

As part of SecureDrop 0.9.0, we announced:

The 3.14.x-series of the Linux kernel has reached end-of-life. While the SecureDrop kernel has been significantly hardened, migrating to the new kernel is of high importance for the security of your instance. For this reason, SecureDrop 0.9.0 will be the last release to preserve a preference for a 3.14.x series kernel.

In other words, we do not want to remove the 3.14.x series yet (to give admins a final escape hatch), but we do want to switch those folks to the latest version as part of 0.10.0.