[xenial] Restart haveged and apparmor

[emkll]

Status

Ready for review

Description of Changes

In the Xenial upgrade scenario, restarting will ensure the AppArmor profiles are correctly loaded so that it can be properly enforced, prior to rebooting.

Fixes #4200

Testing

• Install 0.12.0-rc3 on Trusty
• Upgrade to Xenial
• ssh into app, and run sudo aa-status, observe that haveged is unconfined
• run installer on this branch
• observe haveged restart handler running after apparmor restart handler
• run sudo aa-status and observe that /usr/sbin/haveged is in enforce mode
• to validate idempotency, run installer again, observe the apparmor handler not running

Deployment

Any special considerations for deployment? Consider both:

1. Ansible via ./securedrop-admin install
2. Ansible via ./securedrop-admin install

Checklist

If you made changes to the system configuration:

• Configuration tests pass

If you made non-trivial code changes:

• I have written a test plan and validated it for this PR

[conorsch]

• Install 0.12.0-rc3 on Trusty
• Upgrade to Xenial
• ssh into app, and run sudo aa-status, observe that haveged is unconfined
• run installer on this branch
• observe haveged restart handler running after apparmor restart handler
• run sudo aa-status and observe that /usr/sbin/haveged is in enforce mode
• 🔶 to validate idempotency, run installer again, observe the apparmor handler not running

Changes work as presented. I did not re-run the install action a second time to confirm changes are idempotent, but on visual review of the diff, I'm satisfied with these changes working as expected.