support tests that involve server-side state changes

[cfm]

Description

Orthogonally to #1992, #2252 (review) has demonstrated the value of some test cases that involve server-side changes that can't be initiated from the Client, like the appearance of new source (via the Source Interface) or the deletion of a source on the server (via the Journalist Interface or another Client instance). It would be nice to be able to do one or more of the following, from easiest to hardest:

1. Have tests run scripts (loaddata.py, sqlite ...) inside the running development server.
2. Have tests make specialized calls against a development-only API.
3. "Fuzz" the Client in a duration-based test suite that involves mutating server state accessed by random combinations of valid Client actions.

How will this impact SecureDrop users?

More-obnoxious testing, better automated, means a more-stable Client.