Add basic 4.2 compatibility

[zenmonkeykstop]

Support for Qubes 4.2 was investigated in #898, which updated policies and split out the launcher script to a separate repo, among other changes. A new branch has been created cherry-picking desired changes from this PR, and reinstating the launcher as part of the securedrop workstation repo.

table of cherry-picks and rationales

original commit	status in new branch	notes
052e5a6	NOT INCLUDED	superseded by 4d841fa
4d841fa	NOT INCLUDED	already in main
98b5bb3	INCLUDED	mostly does the bump to f37
4534157	NOT INCLUDED	launcher no longer being split out
c2ce8d4	NOT INCLUDED	already in main
a708a60	NOT INCLUDED	merge commit, already in main
99b72a5	INCLUDED	RPC migration - needs further review tho, to make sure legacy policies aren't overriding the rules here
b127b66	NOT INCLUDED	launcher no longer being split out
416543a	NOT INCLUDED	main already on fedora-38 (we actually need to bump it to fedora-39)
e873481	INCLUDED	handles -xfce suffix, could probably be improved.
5d9dd4d	NOT INCLUDED	main already uses whonix-*-17
9979601	NOT INCLUDED	changed in error
d1aadfc	NOT INCLUDED	revert for above error
4d6ca1a	INCLUDED	-xfce' strikes again
9f9d1d3	INCLUDED	adds workaround as described

 

Further work will proceed using this branch as a base, subtasks as follows:

• Use f39 for fedora system templates, f37 for dom0, whonix-17 for whonix, bookworm repos for sd-* appvm packages
• Convert policy files to new format, and
• Remove backwards compatibility with old qubes-rpc directives #968
• Drop securedrop-workstation-bullseye base template, use a debian-12 system template #969
• Add 6.6.* grsec kernel with PVH support, switch sd-* appvms to PVH
• Update the readme to reference 4.2

Once this level of basic compatibility has been achieved and a running 4.2 workstation can be installed, this branch can be merged to main, switching it to being 4.2-only and allowing for further changes as per the roadmap.