SecureDrop Client localization workflow follow-up

[cfm]

try

#1282's post-merge steps were:

1. https://weblate.securedrop.org/settings/securedrop/securedrop-client/#vcs: Change Repository Branch to main
2. Monitor daily l10n GitHub Actions workflow for successful update-translation-catalogs

except

These turn out to need to be reversed, because:

1. the l10n GitHub actions workflow will regenerate the securedrop_client/locale/messages.pot template...
2. ...without which Weblate will not accept main as the new Repository Branch.

However, (1) is blocked in securedrop-client on main's branch protections, per:

• freedomofpress/infrastructure#3593
• uses repository secret GH_TOKEN for push privileges to main #1308

finally

3. Enable safe-html per freedomofpress/securedrop-security#65
4. Test safe-html filtering
5. Update status of includes compiled translation catalogs in Python source distribution #1294

[cfm]

Per securedrop-security#65: The safe-html flag is now enabled for securedrop-client, in addition to the existing "Unsafe HTML" check.

[cfm]

The steps remaining here are superseded by #1317.