Create securedrop-app-code package with dh-virtualenv and mod_wsgi

Building on freedomofpress#4555,
change the Debian packaging of securedrop-app-code to use
dh-virtualenv, allowing us to embed mod_wsgi in the package.

This means we don't have to include wheels and pip install them during
postinst. Not requiring python3-pip, which isn't available in the apt
repositories in /etc/apt/security.list, means upgrading to Python 3 is
going to be smoother.

The securedrop-app-code Debian package now Conflicts/Replaces
libapache2-mod-wsgi. It will be removed when this new package is
installed.

This requires updates to the builder Docker image, so I've made
changes under molecule/builder-xenial to support building the Debian
packages with a local image.

MANIFEST.in

@@ -1,7 +1,11 @@
-recursive-include securedrop/* *.py *.mako *.sass *.ini *.*
+recursive-include securedrop *.py *.mako *.sass *.ini *.cfg
+prune securedrop/tests
 include securedrop/alembic/*.ini
 include files/etc/apparmor.d/*
 include files/var/www/*
 include *.ini
 include requirements.txt
-include setup.py
+include setup.py
+recursive-exclude . *.pyc
+recursive-exclude . .coverage
+recursive-exclude . .coverage.*

Makefile

@@ -325,13 +325,13 @@ update-user-guides:  ## Run the page layout tests to regenerate screenshots.
 .PHONY: build-debs
 build-debs: ## Build and test SecureDrop Debian packages.
 	@echo "Building SecureDrop Debian packages..."
-	@PYTHON_VERSION=2 REQ=molecule $(SDROOT)/devops/scripts/build-debs.sh
+	@PYTHON_VERSION=3 $(SDROOT)/devops/scripts/build-debs.sh
 	@echo
 
 .PHONY: build-debs-notest
 build-debs-notest: ## Build SecureDrop Debian packages without running tests.
 	@echo "Building SecureDrop Debian packages; skipping tests..."
-	@PYTHON_VERSION=2 $(SDROOT)/devops/scripts/build-debs.sh notest
+	@PYTHON_VERSION=3 $(SDROOT)/devops/scripts/build-debs.sh notest
 	@echo
 
 

changelog.md

@@ -2,8 +2,6 @@
 
 ## 1.0.0~rc1
 
-
-
 ## 0.14.0
 
 ### Web Applications