Freezable APT repository
_Originally created by Tails on [#5926 (Redmine)](https://public-redmine-archive.tails.boum.org/code/issues/5926)_
As a first important milestone before having reproducible builds, having
a way to freeze the Debian repositories would allow to build a given
Tails version with always the same set of packages.
This could be used for example to publish a point release that updates
Tor Browser, but nothing else. If so, we could skip the RC.
Blueprint: https://tails.boum.org/blueprint/freezable_APT_repository/
Feature Branch: feature/5926-freezable-APT-repository
### Subtasks
- [x] tails/tails#9487
- [x] tails/tails#9489
- [x] tails/sysadmin#11412
- [x] tails/sysadmin#11415
- [x] tails/tails#11445
- [x] tails/tails#11447
- [x] tails/tails#11448
- [x] tails/tails#11490
- [x] tails/sysadmin#11496
- [x] tails/sysadmin#11532
- [x] tails/tails#11612
### Related issues
- **Related to** tails/tails#5987
issue