Configure dom0 rpm repo settings via boostrap rpm package

[rocodes]

Status

Ready for review

Description of Changes

Refs #945
Closes #1409 (cherry-picked)

Changes proposed in this pull request:

• Remove yum repo URLs from salt provisioning
• Remove test and prod pubkeys from this repo
• Add make check for staging and dev that ensures that the requisite keyring package is installed
• Remove rpm (re)installation during provisioning: to discuss

Depends on #1405

Testing

If you made non-trivial code changes, include a test plan and validated it for this PR.

Deployment

Any special considerations for deployment? Consider both:

1. Upgrading existing pilot instances
2. New installs

Checklist

If you have made changes to the provisioning logic

• All tests (make test) pass in dom0

If you have added or removed files

• I have updated MANIFEST.in and rpm-build/SPECS/securedrop-workstation-dom0-config.spec

If documentation is required

• I have opened a PR in the docs repo for these changes, or will do so later
• I would appreciate help with the documentation

[rocodes]

This will require #1405 + a rebase for CI (edit: done)

[rocodes]

Right, so even though the package is available, the dev installation uses locally-built rpms, so that's why we're still seeing the openqa failure.

I'm going to add a step to make bootstrap to pull in the prod keyring package.

[rocodes]

Pulling in the dependency on the prod keyring early made things 5% more complicated, I'm putting this briefly back in progress.

[rocodes]

We introduced a problem when we introduced the DIST substitution in the keyring. I've submitted freedomofpress/securedrop-workstation-keyring#30 to correct it; once it's merged I'll rebuild the keyring package for yum-test and yum-test nightlies, then we should be on track.

[legoktm]

LGTM, ready to go once we're satisfied with OpenQA

[rocodes]

Per conversation with @deeplow the openqa failure looks like #1411 and the tests are passing; merging now and will resolve openqa stuff separately