Release qubes-template-securedrop-workstation for Qubes 4.1

[sssoleileraaa]

Note that I am using a similar PR structure as we are aiming to introduce in the prod lfs repo (see freedomofpress/securedrop-yum-prod#31)

Description

Package being released: qubes-template-securedrop-workstation
Package tag: https://github.com/freedomofpress/qubes-template-securedrop-workstation/releases/tag/0.3.0-rc1
Build logs: freedomofpress/build-logs@69b52ce and freedomofpress/build-logs@1920bd4
Test signing key used to sign package and tag: https://github.com/freedomofpress/securedrop-workstation-dev-rpm-packages-lfs/blob/HEAD/pubkeys/test.key

Release tracking issue: freedomofpress/securedrop-yum-prod#33

Checklist for PR owner

• Links in this PR template have been updated as required
• https://github.com/freedomofpress/securedrop-workstation-dev-rpm-packages-lfs/blob/HEAD/pubkeys/test.key points to the correct test signing key

Checklist for reviewer

• CI is passing
• The commits being released are what you expect (see freedomofpress/qubes-template-securedrop-workstation@0.2.3...0.3.0-rc1)
• The RPM is signed with the test signing key

  • Download the signed RPM from this PR
  • Run rpm -qi <signed-rpm> to get the KEY ID
  • Run gpg -k <KEY ID> to verify that it matches the test signing key (make sure you have the test signing key referenced in the PR description in your GPG keyring)

• The Unsigned RPM checksum matches what's in the build logs (see freedomofpress/build-logs@1920bd4)

  • Download the signed RPM from this PR (if you haven't already)
  • Run rpm --delsign <signed-rpm> to remove the signature
  • Run sha256sum <unsigned-rpm> and compare

[sssoleileraaa]

@eaon - It's going to take a long time for my upload of the template to finish (the test file in this draft PR will be deleted as part of the lfs push that we're waiting on). Opening a draft PR to get things ready in the meantime.

[sssoleileraaa]

@eaon - ok, now it should be ready for review

[eloquence]

(DigitalOcean has been flapping for the last 2 hours -- yum-test.securedrop.org seems currently up, but I'd recommend double-checking that again before merge.)

[eaon]

Test plan all checked out 🎉

Note: that the rpm --delsign had to be run on Fedora as the RPM tools on Debian resulted in a different SHA256 sum (thanks @creviera for the help there!)