scap prep: Apply security patches by default

Previously scap prep would only apply security patches when it was
run in "automatic mode" (invoked via --auto or by specifying auto
as the train version).

Now scap prep applies security patches by default, regardless of
"automatic mode". This will help simplify some workflows.

--no-patches can be passed to scap prep to prevent it from
applying patches.

Updated scap stage-train since it no longer needs a separate patch
phase.