Make GnuPG configuration closer to the best practices one (Closes: #7512).

Thanks to Emma Peel and Kill Your TV for the original patches.

The configuration comes straight from:

  * https://help.riseup.net/en/security/message-security/openpgp/best-practices
  * https://github.com/ioerror/duraconf

... modulo these changes:

  * adjust ca-cert-file's location to match where we ship it; this will be fixed
    later on this branch;
  * have communication with keyservers go through Polipo (and in turn, through
    the Tor SOCKS proxy); this is tracked by #7416.

The only removed since our previous configuration is no-auto-key-locate, as it's
actually the default setting.
Symlink the SKS keyservers pool's certificate from the place where duraconf's recommended GnuPG configuration expects it.

... and remove this delta between our configuration and theirs.
Install hopenpgp-tools (from Jessie).

Also fetch libffi6 from testing, hopenpgp-tools needs it, and it's not
in Wheezy.
Update the GnuPG section of the design doc a bit wrt. the changes brought in this branch.
Add a wait_and_hover Sikuli helper method.
Don't click to open a sub-menu in the GNOME applications menu (Closes: #8140).

Just hovering a sub-menu (e.g. "Accessories") and waiting a bit is enough for
the submenu to open. But we did click on it, and if the sub-menu was already
open by hovering, then clicking closed it, of course resulting in FindFailed
exceptions to be thrown.
Factorize starting apps from the GNOME applications menu into a generic step.
Factorize the same as previously, for 2-level submenus.
Look for individual systray applets, to avoid relying on their ordering (Closes: #8059).
Merge branch 'stable' into feature/7512-Make-GnuPG-config-closer-to-duraconf-reworked
Add symlink to make the new apps startup machinery work fine in Windows Camouflage mode too.
Bump test timeouts a bit.

Sometimes, at least in my testing environment, the *icons* in the GNOME
applications menu take longer than 10 seconds to appear, presumably because some
cache is being initialized.
AppArmor: allow Pidgin to run Tor Browser unconfined, with scrubbed environment (Closes: #8186).

We have no Tor Browser profile yet, and it won't work if we make it inherit
Pidgin's confinement, hence we allow Pidgin to run it unconfined. We'll want to
revert this commit once we confine Tor Browser (#5525).
Update patch to include all Intel CPU microcodes (Closes: #8189).

First, make it actually apply on current /etc/default/intel-microcode.

Second, keep using IUCODE_TOOL_SCANCPUS=no, as we still want to include all
microcodes, not only the one(s) for the build machine's CPU.

Third, use forced early mode for IUCODE_TOOL_INITRAMFS:

  * We can't use non-early initramfs mode anymore, since support for it has
    been removed.
  * We could not use "early" mode with the previous version of the
    intel-microcode packaging, since it only supported building on Intel CPU.
  * Quoting debian/changelog: "early" mode now allows a "non-Intel box to
    generate an early initramfs with microcode for an Intel box", and "on auto
    mode, do nothing in a non-intel box. In forced "early" mode, attempt to run
    iucode-tool".

So, this introduces a change in behaviour, but that's the best supported one,
the most robust one, and the one we wanted to use previously but could not.
Merge branch 'bugfix/8189-intel-microcode-v3' into stable
Merge branch 'stable' into test/8140-more-robust-apps-menu
Add placeholder so that we don't forget to document that persistent gpg.conf need to be updated.
Have GnuPG directly use the Tor SOCKS port (Closes: #7416).

This is one step on the road towards removing Polipo (see #5379).
Merge remote-tracking branch 'origin/bugfix/8189-intel-microcode-v3' into stable
Merge remote-tracking branch 'origin/bugfix/8186-pidgin-http-links' into stable