Create Focal-specific securedrop-grsec metapackage

[conorsch]

Description

As part of Focal support (#4768), we must create a new securedrop-grsec metapackage specifically for Focal. Doing so will allow us to preserve the existing Xenial behavior until its EOL (2021-04), and add new functionality for Focal, specifically:

• Using paxctld rather than paxctl Use paxctld to manage all PaX flags in Ubuntu Focal #4134
• Pinning a specific kernel version explicitly (was Marking grsec kernel as default in Focal staging #5507)

Note that we don't currently support installing the locally-built securedrop-grsec metapackage as part of the staging environment, which complicates development and testing somewhat. Might be worthwhile to track that change as part of the new build logic, to aid in review. Otherwise, we'll have to merge logic to build a new package, then upload it to apt-test, and circle back to add tests for its config.