Switch CI jobs to Debian Buster/Python 3.7

[eloquence]

Since we will soon migrate to Debian Buster for all workstation VMs (freedomofpress/securedrop-workstation#306), we should update the CircleCI config in this repository. The test job currently specifies no OS version, which means it is already running on Buster; however, it is using a version of Python older than the one included with Buster (3.7).

$ docker run -it circleci/python:3.5 bash
circleci@94b1a95f6999:/$ cat /etc/debian_version 
10.0

The build job specifies Stretch.

We should update both jobs to Buster, and consider using upstream images instead of the re-tagged CircleCI versions. python:3.7-slim-buster seems like a good fit for both jobs, according to @conorsch.

Because we do not intend to use Stretch much longer and the workstation is in development, we do not need to retain parallel Stretch jobs; we can revisit that if we encounter major issues related to the switch.

[eloquence]

Poked at this briefly just in case it's a simple change, but it's not, so leaving some notes for the implementer. WIP in ci-to-buster.

• The upstream slim-buster image is a little too slim and lacks even sudo, so that'll work only with some extra love.

• Current build/test failure examples here:

  • build failure example
  • test failure example

[eloquence]

For the 11/6-11/20 sprint, we've committed to adding buster build jobs for all relevant repos, and to add a buster test job for the securedrop-export repo.

[kushaldas]

Will push a pr after the evening.