Clean Python cache in prerm only

We are currently cleaning the Python cache in the postinst and postrm,
but that still leaves us with warnings from apt that non-empty
`__pycache__` directories couldn't be deleted.

This mimics what dh-python does, which is to run py3compile in the
postinst (already doing) and run py3clean in the prerm.

During a fresh install, only the postinst is triggered to compile the
cache.

During an upgrade, first the prerm runs, removing the cache, then the
new version is unpacked, then postinst goes, recreating the cache.

Fixes #6743.

securedrop/debian/securedrop-app-code.postinst

@@ -109,10 +109,6 @@ migrate_crontab() {
 #
 #
 refresh_bytecode() {
-    # Remove any existing byte code files, to ensure that obsolete
-    # dependencies can't linger after they've been removed.
-    find "${SDVE}" -name '*.py[co]' -delete
-    find /var/www/securedrop -name '*.py[co]' -delete
     # Now generate the new byte-code
     py3compile "${SDVE}"
     py3compile /var/www/securedrop

securedrop/debian/securedrop-app-code.postrm

@@ -19,17 +19,11 @@ set -e
 # the debian-policy package
 . /usr/share/debconf/confmodule
 
-clean_pyc() {
-    find /var/www/securedrop/ -name '*.pyc' -delete
-    find /var/www/securedrop/ -name __pycache__ -delete
-}
-
 case "$1" in
     upgrade|failed-upgrade)
     ;;
 
     remove|abort-install|abort-upgrade|disappear)
-        clean_pyc
     ;;
 
     purge)

securedrop/debian/securedrop-app-code.prerm

@@ -0,0 +1,40 @@
+#!/bin/sh
+# prerm script for securedrop-app-code
+#
+# See: dh_installdeb(1).
+
+set -e
+
+# Summary of how this script can be called:
+#        * <prerm> 'remove'
+#        * <old-prerm> 'upgrade' <new-version>
+#        * <new-prerm> 'failed-upgrade' <old-version>
+#        * <conflictor's-prerm> 'remove' 'in-favour' <package> <new-version>
+#        * <deconfigured's-prerm> 'deconfigure' 'in-favour'
+#          <package-being-installed> <version> 'removing'
+#          <conflicting-package> <version>
+# for details, see https://www.debian.org/doc/debian-policy/ or
+# the debian-policy package.
+
+
+case "$1" in
+    remove|upgrade|deconfigure)
+        py3clean /opt/venvs/securedrop-app-code
+        py3clean /var/www/securedrop
+    ;;
+
+    failed-upgrade)
+    ;;
+
+    *)
+        echo "prerm called with unknown argument '$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0