build: handle APT archive/keyring updates in-package

Quoting:

Thanks. We have a bunch of ways in APT to alert people of repository changes. I can figure out if there's a way for you to (ab)use that to notify people to refresh their key.

The convention for a keyring package would be syncthing-archive-keyring installing /usr/share/keyrings/syncthing-archive-keyring.gpg; but also just dropping the keyring into the main syncthing package works fine.

I tend to like the Google model where they stuff the source file into the deb, given that its a single deb in the repo, i.e. ship

$ cat /etc/apt/sources.list.d/syncthing.sources
Types: deb
URIs: https://apt.syncthing.net/
Suites: syncthing
Components: stable
Signed-By: /usr/share/keyrings/syncthing-archive-keyring.gpg

But it's weird to migrate people by shipping a static file in an existing package. But what you can do:

1. Ship the keyring
2. ship the sources files in examples.
3. On fresh installs, setup automatic updates from the deb postinst

if [ "$1" = "configure" ] && [ -z "$2" ]; then
    cp /usr/share/doc/syncthing/syncthing.sources /etc/apt/sources.list.d/
fi

4. Point people to download the deb

That's sort of the Google Chrome approach to packaging.

Originally posted by @julian-klode in https://github.com/syncthing/syncthing/issues/9831#issuecomment-2497715159

Start by locating the Debian package build and postinst entry point, then review how syncthing.sources and the archive keyring would be included. Compare the proposed fresh-install setup with migration behavior for existing APT users. Done means the package handles the keyring and source-file updates without disrupting existing installations.