WIP: Script to upgrade from focal to noble

The script is split into various stages where progress is tracked
on-disk. The script is able to resume where it was at any point, and
needs to, given multiple reboots in the middle.

Given that we want to invoke the check script during the upgrade path,
most of the code is moved into a common lib.rs that can be imported by
both check.rs and upgrade.rs.

The new noble-upgrade.json file shipped in the securedrop-config package
is used to control the upgrade process.

A systemd timer runs every 3 minutes to trigger the upgrade script,
which in most cases will do nothing. We need to run it so frequently
since this is how the script will be restarted after it pauses for a
reboot.

Fixes #7332.

noble-migration/Cargo.toml

@@ -5,6 +5,9 @@ edition = "2021"
 
 [dependencies]
 anyhow = "1.0.93"
+env_logger = { version = "0.11.5", features = ["humantime"] , default-features = false }
+log = "0.4.22"
+rand = "0.8.5"
 rustix = { version = "0.38.40", features = ["process"] }
 serde = { version = "1.0.215", features = ["derive"] }
 serde_json = "1.0.132"

noble-migration/files/apt_freedom_press.list

@@ -0,0 +1 @@
+deb [arch=amd64] https://apt.freedom.press noble main

noble-migration/files/sources.list

@@ -0,0 +1,13 @@
+## newer versions of the distribution.
+deb http://archive.ubuntu.com/ubuntu/ noble main
+
+## newer versions of the distribution.
+deb http://archive.ubuntu.com/ubuntu/ noble universe
+
+## Major bug fix updates produced after the final release of the
+## distribution.
+deb http://archive.ubuntu.com/ubuntu/ noble-updates main
+
+### Security fixes for distribution packages
+deb http://security.ubuntu.com/ubuntu noble-security main
+deb http://security.ubuntu.com/ubuntu noble-security universe

noble-migration/files/ubuntu.sources

@@ -0,0 +1,11 @@
+Types: deb
+URIs: http://archive.ubuntu.com/ubuntu/
+Suites: noble noble-updates
+Components: main universe restricted multiverse
+Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg
+
+Types: deb
+URIs: http://security.ubuntu.com/ubuntu/
+Suites: noble-security
+Components: main universe restricted multiverse
+Signed-By: /usr/share/keyrings/ubuntu-archive-keyring.gpg