Use paxctl for Xenial, paxctld for Focal

[conorsch]

Status

Ready for review

Description of Changes

Closes #3916.

Continues to use paxctld under Xenial, same as always, but removes any
use of it under Focal, where paxctld is already preferred.

Updated the tests accordingly. Removes an unused (xfail) paxctl test,
since it wasn't running anyway. Preserved the "paxctld" dependency for
securedrop-app-code, since the postinst logic still uses it. We can
remove that after OS migration.

Removes mention of the 4.14.x kernel series for Focal, as well, since we
don't plan to support that series post-Xenial.

Testing

• Visual review of test changes
• CI passing is sufficient

Deployment

Changes are Focal-specific, Xenial behavior has been preserved.

Checklist

If you made changes to the server application code:

• Linting (make lint) and tests (make test) pass in the development container

If you made changes to securedrop-admin:

• Linting and tests (make -C admin test) pass in the admin development container

If you made changes to the system configuration:

• Configuration tests pass

If you added or removed a file deployed with the application:

• I have updated AppArmor rules to include the change

If you made non-trivial code changes:

• I have written a test plan and validated it for this PR

Choose one of the following:

• I have opened a PR in the docs repo for these changes, or will do so later
• I would appreciate help with the documentation
• These changes do not require documentation

If you added or updated a code dependency:

Choose one of the following:

• I have performed a diff review and pasted the contents to the packaging wiki
• I would like someone else to do the diff review

[kushaldas]

This looks sound. The tests are good. Approved.

[kushaldas]

Finally :)