Move package dependency logic from Ansible to apt

[emkll]

Feature request

Description

Apt package dependencies are currently managed by Ansible. Move dependency package to debian/control and add package dependencies, e.g:

securedrop-app-code-$RELEASE Depends: securedrop-ossec-agent, securedrop-ossec-server, securedrop-keyring)

User Stories

As a SecureDrop infrastructure developer, I would like simplify Ansible logic and defer the logic to apt instead.

[conorsch]

We've certainly made progress toward this end (e.g. #4134), but not enough to close. A comprehensive look at Ansible package management logic, with #2724.

[eloquence]

Adding to near-term backlog for consideration as a relatively low hanging fruit improvement to our provisioning story.

[eloquence]

@conorsch is doing a first spike on this today, so moving to current sprint.

[eloquence]

Some progress was made towards this as part of the 1.8.0 push:

• aptitude was removed
• cron-apt is no longer used
• paxctl is replaced by paxctld and tracked in the control file

We are still installing some dependencies via playbook, and may take future opportunities to do further refactoring, so keeping this issue open but removing from near-term backlog.