Remove old kernels from long-running templates

[emkll]

Because linux-headers and linux-image packages are pulled in via apt dependency (securedrop-workstation-grsec metapackage), when the metapackage, headers and image are updated, the previous versions will remain installed. we should run autoremove as part of the update process (maybe the launcher?) to ensure we don't exhaust system storage.

A single kernel/header version takes ~650MB on disk (system storage default is 10GB, with ~50% used)

[conorsch]

Should be resolved by #722, specifically https://github.com/freedomofpress/securedrop-workstation/pull/722/files#diff-c53f24489d05b8fbea9800086d050eb3ae5afa8742c864c0f655f8a78870a017R24-R28 Not marking as closed until we observe that change cleaning up historical kernel packages on a staging instance.

[legoktm]

Indeed, this was fixed back in 2021 in 46abb0b which added apt-get autoremove -y to the update process.