Include Qubes apt repository/packages in our CI testing setup

[legoktm]

Description

As we work on more sophisticated testing and tighter integration with Qubes, we are starting to reach the limit of what we can do in "plain Debian containers" (i.e. debian:{bullseye,bookworm} images) and would benefit from including Qubes packages.

Two usecases:

• [4.2] Write vm-specific config values to qubesdb securedrop-workstation#936 (comment) / feat(Config): read from QubesDB if available; otherwise from environment variables #1883 wants to link our Python/Rust code with libqubesdb
• in Have CI run piuparts #1844 we skipped testing against the workstation-viewer package because it transitively pulls in Qubes's qubes-kernel-vm-support package (via the grsec kernel).

At a conceptual level, this involves pulling down the Qubes signing key and adding the appropriate sources.list line.

[legoktm]

I somewhat started on this in 4853d4b, it's easiest if we commit the Qubes repo signing key (I pulled it out of a VM) and then add the sources.list file. Unsure if this is simple enough for CI or we'll want something easier (a pre-built Docker image with the SD and Qubes keys??)