Configure FPF apt repo early in provisioning

[conorsch]

Right now, the FPF apt repo—whether apt-test or apt—is configured after we run the upstream Qubes salt state for upgrading all packages within a VM:

securedrop-workstation/dom0/fpf-apt-test-repo.sls

Lines 10 to 11 in 9cb41a8

	include:
	- update.qubes-vm

Let's switch that logic, so the apt repo is configured first, and the full package upgrade at install time includes the FPF apt repo. A bit more indirection is likely the solution, so that a new state file includes both the upstream logic and the FPF apt repo logic. Fine opportunity to resolve #572, as well.