Don't add key_url as it is deprecated and not needed when
pkgrepo_keyring is set. This has been supported since stretch so make it
the default. Also use py3 repo by default for Debian family as it is now
the only option.

Additionally, Raspbian has been updated to use signed-by by default.

Also:

* add keyring file for the salt repo, due to `apt-key` deprecation
* remove old repository file

Use the following command:

```
$ GREP_SED="^\(\s\+master_type: \)true" \
  && grep -rl "${GREP_SED}" test/integration/ \
  | xargs sed -i -e "/${GREP_SED}/s//\1str/"
```

Use the following command:

```
$ GREP_SED="\(repo\.salt\)stack\.com" \
  && grep -rl --exclude-dir=.git "${GREP_SED}" \
  | grep -v .un~$ \
  | xargs sed -i -e "/${GREP_SED}/s//\1project.io/g"
```

```
$ GREP_SED="\(pkgrepo: deb http\):" \
  && grep -rl "${GREP_SED}" test/integration/v* \
     | xargs sed -i -e "/${GREP_SED}/s//\1s:/"
```

* CVE-2021-25283 enables Jinja2 safe mode, which breaks use of
  `'dict' in x.__class__.__name__` workaround
* Workaround no longer needed as CentOS 6 is EOL