Replace sed commands with file.line

[conorsch]

The current Salt provisioning logic uses awkwardly constructed sed invocations, with a conditional grep duplicating the regex, to ensure files are added to qubes-rpc files in dom0. We should instead use the Salt file.line module to implement these lines in files. By way of example:

Before

sed -i '1isd-journalist sd-decrypt allow' /etc/qubes-rpc/policy/qubes.OpenInVM:
  cmd.run:
    - unless: grep -qF 'sd-journalist sd-decrypt allow' /etc/qubes-rpc/policy/qubes.OpenInVM

After

[untested example code]

/etc/qubes-rpc/policy/qubes.OpenInVM:
  file.line:
    - content: sd-journalist sd-decrypt allow
    - mode: insert
    - location: start

The latter is much more readable, and removes duplication of both the regular expression and the filepath. There are a few places in the config that should be fixed:

• dom0/sd-decrypt.sls:39:sed -i '1i$tag:sd-decrypt-vm sd-gpg allow' /etc/qubes-rpc/policy/qubes.Gpg:
• dom0/sd-decrypt.sls:44:sed -i '1isd-decrypt sd-svs allow' /etc/qubes-rpc/policy/qubes.OpenInVM:
• dom0/sd-journalist.sls:41:sed -i '1isd-journalist sd-decrypt allow' /etc/qubes-rpc/policy/qubes.OpenInVM:
• dom0/sd-journalist.sls:47:sed -i '1isd-journalist $dispvm:sd-decrypt allow' /etc/qubes-rpc/policy/qubes.OpenInVM:
• dom0/sd-svs-disp.sls:36:sed -i '1i$tag:sd-svs-disp-vm sd-svs allow' /etc/qubes-rpc/policy/qubes.OpenInVM:
• dom0/sd-svs.sls:26:sed -i '1isd-svs $dispvm:sd-svs-disp allow' /etc/qubes-rpc/policy/qubes.OpenInVM:

[redshiftzero]

closed by #140 #146