Use di-netboot-assistant in a safer way

Originally created by @intrigeri on #10092 (Redmine)

As discussed on tails/tails#8507, our current usage is not super safe. With di-netboot-assistant 0.39 we could do better, as its changelog reads:

* Implement the inclusion of debian-installer packages. Add
instructions to the README and a warning when installing insecurely.

Let’s try that!

Edited May 15, 2020 by intrigeri