Enable APT seccomp sandboxing

It was disabled in apt (1.6~rc1) because it breaks in some cases. But we support a tiny subset of possible cases so it might work for us, in which case we should enable it. See https://github.com/julian-klode/apt/commit/e688a4f4890c04021468932e57e17891853c8443 for details and how to reenable it.

Original created by @intrigeri on 15786 (Redmine)

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information