api: expose gpg fingerprint of source

[redshiftzero]

Status

Ready for review

Description of Changes

Fixes #3911 (implemented to unblock a simple solution to freedomofpress/securedrop-client#363)

Testing

0. make -C securedrop dev

1. Get API token (replacing 2FA token below with the correct token):

curl -X POST -H "Content-Type: application/json" --data '{"username":"journalist","passphrase":"correct horse battery staple profanity oil chewy","one_time_code":"123456"}' 127.0.0.1:8081/api/v1/token

1. Verify you see the fingerprint in the key object for a source:

curl -X GET -H "Content-Type: application/json" -H "Authorization: Token MyTokenFromResponseAboveGoesHere" 127.0.0.1:8081/api/v1/sources

Deployment

None, will be deployed via securedrop-app-code package to all instances

Checklist

If you made changes to the server application code:

• Linting (make ci-lint) and tests (make -C securedrop test) pass in the development container

If you made non-trivial code changes:

• I have written a test plan and validated it for this PR

If you made changes to documentation:

• Doc linting (make docs-lint) passed locally

[codecov-io]

Codecov Report

Merging #4436 into develop will decrease coverage by 0.03%.
The diff coverage is n/a.

@@             Coverage Diff             @@
##           develop    #4436      +/-   ##
===========================================
- Coverage    83.76%   83.72%   -0.04%     
===========================================
  Files           44       44              
  Lines         2950     2956       +6     
  Branches       321      321              
===========================================
+ Hits          2471     2475       +4     
- Misses         402      404       +2     
  Partials        77       77

Impacted Files	Coverage Δ
securedrop/securedrop/models.py	92.63% <0%> (-0.49%)	⬇️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ff00f4c...4ff62ad. Read the comment docs.

[heartsucker]

Followed the test plan, and additionally imported a key to a GPG keyring and confirmed that the fingerprint matches.