[securedrop-proxy] Ensure proxy only starts inside sd-proxy VM

[conorsch]

Towards freedomofpress/securedrop-workstation#471.

As with #1141, we should prevent the proxy from starting in any context: we want to ensure that we're inside sd-proxy, since the required secrets will only be available inside that VM as part of the private volume (#77). We can use an approach similar to #1153, i.e. qubesdb-read /name.