Trim down SquashFS exclusions: remove obsolete ones, move as much as possible to chroot_local-hooks

This will help migrate to gensquashfs.

I've verified with the attached script that the contents of the resulting SquashFS is essentially the same:

$ sudo ./compare-isos-squashfs-file-listing tails-amd64-stable@aeb20a24d2-20211103T0927Z.iso tails-amd64-18655-clean-up-squashfs-excludes@49db531e88+stable@aeb20a24d2-20211103T1032Z.iso
+ [ 2 -eq 2 ]
+ mount tails-amd64-stable@aeb20a24d2-20211103T0927Z.iso old-iso
mount: /srv/ftp/intrigeri/iso/tails/dev/old-iso: WARNING: source write-protected, mounted read-only.
+ mount tails-amd64-18655-clean-up-squashfs-excludes@49db531e88+stable@aeb20a24d2-20211103T1032Z.iso new-iso
mount: /srv/ftp/intrigeri/iso/tails/dev/new-iso: WARNING: source write-protected, mounted read-only.
+ mount old-iso/live/filesystem.squashfs old-squashfs
+ mount new-iso/live/filesystem.squashfs new-squashfs
+ diff -r --brief --no-dereference old-iso/ new-iso/
Files old-iso/live/filesystem.squashfs and new-iso/live/filesystem.squashfs differ
+ :
+ diff -r --brief --no-dereference old-squashfs/ new-squashfs/
Files old-squashfs/etc/amnesia/version and new-squashfs/etc/amnesia/version differ
Only in old-squashfs/usr/share/inkscape: examples
Files old-squashfs/usr/share/tails/build/mksquashfs-excludes and new-squashfs/usr/share/tails/build/mksquashfs-excludes differ

… so I don't think it's worth waiting for CI results.

refs #18655

compare-isos-squashfs-file-listing