Upgrade our infrastructure to Debian 12 (Bookworm)

At this stage, the only reason I'm creating this issue is to ensure it's on our radar when roadmapping. In passing, this could fit very well into the scope of Sponsor 11.

Assuming Bookworm is released mid-2023:

• security support for Bullseye will end 1 year later: mid-2024
• Bullseye LTS should be supported for 2 more years, until mid-2026

To Do

• Migrate away from deprecated apt-key(8) (#17898 - closed)
• Upgrade Puppet to version 7 (#17937 - closed)

Upgrade physical servers:

• Skink
• Iguana
• Dragon
• Lizard
• Stone

Upgrade 3rd-party VMs:

• teels.tails.boum.org
• ecours.tails.boum.org

Upgrade self-hosted VMs:

• apt.lizard
• apt-proxy.lizard
• bitcoin.lizard
• bittorrent.lizard
• bridge.lizard
• dns.lizard
• mail.lizard
• misc.lizard
• puppet.lizard
• puppet-git.lizard
• rsync.lizard
• survey.lizard
• translate.lizard
• whisperback.lizard
• www.lizard
• isoworker1.dragon
• isoworker2.dragon
• isoworker3.dragon
• isoworker4.dragon
• isoworker5.dragon
• jenkins.dragon
• gitlab-runner.iguana
• isoworker6.iguana
• isoworker7.iguana
• isoworker8.iguana

Follow-ups

• install virt-viewer from the isotester-bookworm suite in our custom APT repo in ISO testers/workers (see: tails!1223 (comment 216622))
• Once Jenkins workers are upgraded: poke FT on tails#19487 (closed)
• Bookworm has a newer version of po4a (0.69), should we upgrade?