Use di-netboot-assistant in a safer way

As discussed on #8507 (closed), our current usage is not super safe. With di-netboot-assistant 0.39 we could do better, as its changelog reads:

* Implement the inclusion of debian-installer packages. Add
instructions to the README and a warning when installing insecurely.

Let’s try that!

Original created by @intrigeri on 10092 (Redmine)

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information