Installs release-upgrader in prepare-servers role

Closes #5781. Adds the package to an early run, mostly
to satisfy dev/testing environments where deb packages are installed
directly as part of test runs.

Also updates the "python" -> "python3" in the same task, since on Focal
the former would result in (EOL'd) python2 being unnecessarily installed.
Updated tests to match.

install_files/ansible-base/roles/prepare-servers/tasks/main.yml

@@ -21,15 +21,15 @@
       SecureDrop cannot be installed. For details, see
       https://github.com/freedomofpress/securedrop/issues/4058
 
+- name: Install python and packages required by installer
+  raw: apt install -y python3 apt-transport-https dnsutils ubuntu-release-upgrader-core
+  register: _apt_install_prereqs_results
+  changed_when: "'0 upgraded, 0 newly installed, 0 to remove' not in _apt_install_prereqs_results.stdout"
+
 - name: Remove cloud-init
   apt:
     name: cloud-init
     state: absent
     purge: yes
   tags:
     - apt
-
-- name: Install python and packages required by installer
-  raw: apt install -y python apt-transport-https dnsutils
-  register: _apt_install_prereqs_results
-  changed_when: "'0 upgraded, 0 newly installed, 0 to remove' not in _apt_install_prereqs_results.stdout"

molecule/testinfra/common/test_release_upgrades.py

@@ -3,6 +3,15 @@
 test_vars = testutils.securedrop_test_vars
 testinfra_hosts = [test_vars.app_hostname, test_vars.monitor_hostname]
 
+def test_release_manager_installed(host):
+    """
+    The securedrop-config package munges `do-release-upgrade` settings
+    that assume the release-upgrader logic is installed. On hardware
+    installs of Ubuntu, it is, but the VM images we use in CI may
+    remove it to make the boxes leaner.
+    """
+    assert host.package("ubuntu-release-upgrader-core").is_installed
+
 
 def test_release_manager_upgrade_channel(host):
     """

molecule/testinfra/common/test_system_hardening.py

@@ -148,6 +148,7 @@ def test_no_ecrypt_messages_in_logs(host, logfile):
 @pytest.mark.parametrize('package', [
     'cloud-init',
     'libiw30',
+    'python-is-python2',
     'snapd',
     'wireless-tools',
     'wpasupplicant',