Initial Debian packaging for SecureDrop App

[legoktm]

This is a very initial pass at the packaging, getting something that can be installed in a VM. It is not a finished version of the packaging (so it doesn't close the issue).

Refs #2703.

Test plan

Testing this along with freedomofpress/securedrop-workstation#1497 might make it simpler

• Installing the securedrop-app deb in a appVM works if you run touch ~/.config/SecureDrop/public.key && securedrop-app --no-sandbox.

Checklist

This change accounts for:

• testing changes on Qubes as needed (especially changes related to cryptography, export, disposable VM use, or complex UI changes)
• any needed updates to the AppArmor profile for files beyond the application code
• any needed self-contained database migrations (including testing against a clean test database from main)