Publish / make use of .buildinfo files for RPM packages

[eaon]

Adding this here as it would apply to securedrop-updater as well as securedrop-workstation

I just noticed that QubesOS publishes .buildinfo files for RPM packages (example), and it turns out they use a relatively simple script for this. They also have a tool to verify reproducibility that take these files as input.

I think following their example here would be cool, though it would require us to switch up how we build RPM packages right now (adding a step to create SRPMs).