deploy: set vm-config features for sd-{app,proxy,whonix}

[cfm]

Status

Ready for review

Description of Changes

Towards #936 (superseding #956 due to its skip-ci/ prefix):

1. sets values from the dom0 config.json to keys under the vm-config/ prefix in QubesDB (under the vm-config. prefix in Salt); and
2. tests all VMs for expected configuration keys, eliminating the special-casing of QUBES_GPG_DOMAIN;
3. tests configured VMs for their expected values from config.json; and
4. leaves TODO hints in state files that can be removed as each VM's applications are updated to read configuration from this store, as in feat(Config): read from QubesDB if available; otherwise from environment variables securedrop-client#1883, and their Salt-managed configuration files can be removed.

Testing

With this branch checked out in your $SECUREDROP_DEV_VM:

[user@dom0 securedrop-workstation]$ make clone
[user@dom0 securedrop-workstation]$ make dev

Now you can poke around (e.g.):

[user@dom0 securedrop-workstation]$ qvm-run --pass-io sd-app qubesdb-read /vm-config/QUBES_GPG_DOMAIN
sd-gpg
[user@dom0 securedrop-workstation]$ qvm-run --pass-io sd-app qubesdb-read /vm-config/SD_SUBMISSION_KEY_FPR
5F4BB12BAF811C789347DDFF148B87347CB3DDA1

That's it! Since nothing downstream consumes from this configuration store yet, it has no side effects.

Extra credit

Test the enforcement of expected configuration keys:

[user@dom0 securedrop-workstation]$ qubesdb-write -d sd-proxy /vm-config/QUBES_GPG_DOMAIN "you shouldn't have this"
[user@dom0 securedrop-workstation]$ make test-proxy  # Expected: "AssertionError: Items in the first set but not the second..."

Deployment

As part of work towards #965, this assumes a fresh installation (except during testing) and so has no special considerations.

Checklist

If you have made changes to the provisioning logic

• All tests (make test) pass in dom0

[legoktm]

Awesome, this looks great. Test plan checked out (qubesdb-read works properly, setting another key causes tests to fail).

Explicitly noting that the PGP secret key is not included in this PR, per #936 (comment) and follow-up discussion.

One other thing I was curious about is whether we need to explicitly delete these or if they're removed as part of VM deletion. So I set an extra key (as part of the earlier testing), did a sdw-admin --uninstall && make dev and that key is (correctly) missing.