Have update-changelog normalize versions to ensure native packages

[legoktm]

• Apply s/-/~/g to the specified version so we always end up with native packages (no Debian revision in the version number).

Fixes #431.

Test plan

• [x] Run PKG_VERSION=0.10.0-rc1 ./scripts/update-changelog securedrop-client, get a diff like:

--- a/securedrop-client/debian/changelog-buster
+++ b/securedrop-client/debian/changelog-buster
@@ -1,3 +1,9 @@
+securedrop-client (0.10.0~rc1+bullseye) unstable; urgency=medium
+
+  * see changelog.md
+
+ -- SecureDrop Team <securedrop@freedom.press>  Fri, 17 Mar 2023 19:15:49 +0000
+

(note the version being 0.10.0~rc1+bullseye)

• [x] Manually set the version to 0.10.0-rc1+bullseye (dash not tilde) in securedrop-client's changelog-buster, try PKG_GITREF=main make securedrop-client, should get an error message like:

  ...
  dpkg-source -b .
  dpkg-source: error: can't build with source format '3.0 (native)': native package version may not have a revision
  dpkg-buildpackage: error: dpkg-source -b . subprocess returned exit status 255
  make: *** [Makefile:10: securedrop-client] Error 255

[legoktm]

I switched it to /g and then set the source format for each package to enforce native packages, plus one more thing in the test plan.