Add support for file conversion and metadata removal

[redshiftzero]

We need to make sure that documents exported from the SecureDrop workstation onto the regular journalist's workstation for publication have malware and metadata removed from them.

Copying from SecureDrop server side ticket freedomofpress/securedrop#543:

1. qvm-convert-pdf does convert images (to PDFs) as well using DispVMs, though the "convert to trusted PDF" option does not appear unless you add the .PDF suffix to the file
2. there is actually already a variant of this for images qvm-convert-img (not installed by default, but I tried it out and it works great) that you can install in Qubes to go directly from e.g. PNG to trusted PNG using the same opening in a DispVM approach

Also see relevant upstream ticket: freedomofpress/securedrop#160

[redshiftzero]

In addition to removing metadata, part of this workflow is just physically getting documents off the workstation. Here are three basic ways, the first two which are currently used by journalists using Tails in SecureDrop:

1. Print the document: Journalists should be able to continue to use SecureDrop-dedicated printers for printing documents to share in the newsroom. If spooky random printer drivers from the internet need to be installed, this should occur in a separate VM.
2. Transfer using USB drive: Journalists should be able to connect a USB drive (using USB passthrough) to transfer documents. The UX is going to be a bit gnarly here at first.
3. Onionshare: This is a nice possibility now that we're using an internet connected workstation.

[eloquence]

This is now out of scope for the alpha; we will merely provide documentation for the intended export workflow(s) for audit review. See also the related client issue: freedomofpress/securedrop-client#21

[eloquence]

The print/export portion of this is tracked in this epic:
#290

[zenmonkeykstop]

A proposal for this is in play, most likely leveraging Dangerzone. Leaving open for now. Some questions remain about metadata handling (for example, "silently scrub vs. report any found?").