dm restrict audit: install newer chiark-scripts for fishdescriptor

dm restrict audit: install newer chiark-scripts for fishdescriptor

fishdescriptor is not in stretch or earlier.  It will be in buster,
and we expect that a suitable version will be available in
stretch-backports soon.

For jessie, use DebianExtraPackages to install the .deb from buster
(which is directly installable on jessie).

Deployment note: I have already copied the .deb to the images
directories in Massachusetts and Cambridge.

Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com>