Removes package updates from sd-log AppVM config

[conorsch]

Status

Ready for review

Description of Changes

Refs #514

Changes proposed in this pull request:

The logging config must ensure that the necessary FPF apt repos are in
place, but the repo configs should only be applied for TemplateVMs. For
netless AppVMs, the call will fail if updates are available.

Testing

First, make sure you can repro the failure scenario described in #514 (comment) Then, in a dev environment:

make clone
make clean
make all
make test

and observe all tests passing. Further research required for testing clean prod/staging installs. I've not done that yet.

Checklist

If you have made code changes

• Linter (make flake8) passes in the development environment (this box may
  be left unchecked, as flake8 also runs in CI)

If you have made changes to the provisioning logic

• All tests (make test) pass in dom0 of a Qubes install

• This PR adds/removes files, and includes required updates to the packaging
  logic in MANIFEST.in and rpm-build/SPECS/securedrop-workstation-dom0-config.spec

[emkll]

While I could not reproduce the underlying issue (see #514 (comment)), the changes here are sound. Not formally approving since marked WIP.

[emkll]

Do you think it would be best to explicitly list all the sd- managed template VMs here in a list, instead of relying on "template" in the name? It don't think there will be any functional improvements (due to sd-workstation.top), but it may make this part easier to understand/maintain

[conorsch]

Ideally, we'd use qubesdb-read /qubes-vm-type and select based on whether the value is "TemplateVM". The salt jinja templates are rendered in dom0, though, and we currently cannot leverage onlyif to the problems we saw in #485, so settling on no changes for now.

[emkll]

@conorsch these changes look good to merge, from my perspective. However, there's a WIP tag. Is this ready for final review?

[conorsch]

Ready for review. Kept the WIP tag on because I was seeing a bit of variability in the behavior, about whether the change was strictly necessary. Agreed that we want the cleanup either way, so fine with merging.

[emkll]

Thanks @conorsch, went through the test plan and doesn't introduce any regressions, the changes introduced here are sound.