runpromises: support software releases older than slapos 1.0.118

Before slapos commit a184cca8b (Try to reuse existing file to avoid
excessive IO on update + other minor optimisations, 2019-06-17), which
started to be used in profiles in 65acdca0d (Release slapos.cookbook
(1.0.118), 2019-08-13), the promise plugins did not contain

    import sys
    sys.path[0:0] = (..., )

but there was an extra import statement:

    import sys
    import json
    sys.path[0:0] = (..., )

slapos.core >= 1.7 was not able to process such promises, because the
code introspecting these promises assumed that the second node of the
AST was the assignment, which is incorrect in the old promises because
it was another import.

To accomodate both cases, use the value from the first assignment.

We also change to use ast.literal_eval for safety.