runpromises: support software releases older than slapos 1.0.118

Before slapos commit a184cca8b (Try to reuse existing file to avoid excessive IO on update + other minor optimisations, 2019-06-17), which started to be used in profiles in 65acdca0d (Release slapos.cookbook (1.0.118), 2019-08-13), the promise plugins did not contain

import sys
sys.path[0:0] = (..., )

but there was an extra import statement:

import sys
import json
sys.path[0:0] = (..., )

slapos.core >= 1.7 was not able to process such promises, because the code introspecting these promises assumed that the second node of the AST was the assignment, which is incorrect in the old promises because it was another import.

To accomodate both cases, use the value from the first assignment.

We also change to use ast.literal_eval for safety.