Avoid initially pushed branch failing its pipeline

If we push before bumping the APT snapshot's expiry date,
the first run of the GitLab CI pipeline will fail,
and then the author of the MR gets notified and has to go
re-run the failing job after bumping the expiry date.

To fix this, let's bump the expiry date before we push the branch
that switches to a new APT snapshot.

Worst case, if it turns out that's not the snapshot we want,
no big deal: deb.torproject.org is pretty small, keeping
1 extra snapshot for a few months won't hurt.