Create securedrop-app-code package with dh-virtualenv and mod_wsgi

Building on freedomofpress#4555,
change the Debian packaging of securedrop-app-code to use
dh-virtualenv, allowing us to embed mod_wsgi in the package.

This means we don't have to include wheels and pip install them during
postinst. Not requiring python3-pip, which isn't available in the apt
repositories in /etc/apt/security.list, means upgrading to Python 3 is
going to be smoother.

The securedrop-app-code Debian package now Conflicts/Replaces
libapache2-mod-wsgi. It will be removed when this new package is
installed.

This requires updates to the builder Docker image, so I've made
changes under molecule/builder-xenial to support building the Debian
packages with a local image.

Noting for future removal: this includes a workaround for
pallets-eco/flask-wtf#275 -- after upgrading
from Python 2 to Python 3, any existing session's csrf_token value
will be retrieved as bytes, causing a TypeError. This simple fix,
deleting the existing token, was suggested in the issue comments. This
code will be safe to remove after Python 2 reaches EOL in 2020, and no
supported SecureDrop installations can still have this problem.

MANIFEST.in

@@ -1,7 +1,9 @@
-recursive-include securedrop/* *.py *.mako *.sass *.ini *.*
-include securedrop/alembic/*.ini
-include files/etc/apparmor.d/*
-include files/var/www/*
-include *.ini
+graft debian
+graft etc
+graft var
+prune var/www/securedrop/tests
 include requirements.txt
-include setup.py
+include setup.py
+recursive-exclude . *.pyc
+recursive-exclude . .coverage
+recursive-exclude . .coverage.*

Makefile

@@ -325,13 +325,13 @@ update-user-guides:  ## Run the page layout tests to regenerate screenshots.
 .PHONY: build-debs
 build-debs: ## Build and test SecureDrop Debian packages.
 	@echo "Building SecureDrop Debian packages..."
-	@PYTHON_VERSION=2 REQ=molecule $(SDROOT)/devops/scripts/build-debs.sh
+	@PYTHON_VERSION=3 $(SDROOT)/devops/scripts/build-debs.sh
 	@echo
 
 .PHONY: build-debs-notest
 build-debs-notest: ## Build SecureDrop Debian packages without running tests.
 	@echo "Building SecureDrop Debian packages; skipping tests..."
-	@PYTHON_VERSION=2 $(SDROOT)/devops/scripts/build-debs.sh notest
+	@PYTHON_VERSION=3 $(SDROOT)/devops/scripts/build-debs.sh notest
 	@echo
 
 

changelog.md

@@ -2,8 +2,6 @@
 
 ## 1.0.0~rc1
 
-
-
 ## 0.14.0
 
 ### Web Applications