Adds qubes-vm-recommended pkg to template

Due to a regression with sudo password handling, we now explicitly pull
in the `qubes-vm-recommended` package, which pulls in
`qubes-core-agent-passwordless-root` via dependencies. This is a
quick fix, and we should investigate the upstream builder logic more
deeply to resolve fully.

securedrop-workstation/04_install_qubes_post.sh

@@ -33,7 +33,7 @@ fi
 
 mount --bind /dev "${INSTALLDIR}/dev"
 
-aptInstall apt-transport-https
+aptInstall apt-transport-https qubes-vm-recommended
 
 [ -n "$workstation_repository_suite" ] || workstation_repository_suite="buster"
 [ -n "$workstation_signing_key_fingerprint" ] || workstation_signing_key_fingerprint="22245C81E3BAEB4138B36061310F561200F4AD77"