…ring onboarding

By using ssh-add before ssh-copy-id on the new Admin Workstation 2
(AW2), all steps once Tails is installed on AW2 can take place on AW2
with the existing Admin Workstation 1 (AW1) unlocked, rather than
running some steps on AW2 with AW1 unlocked and some steps on AW1 with
AW2 unlocked.

This adds a couple of shell commands (a possible source of error) but
removes 5 steps and some shuffling of thumb drives (a different possible
source of error).

Assumptions:
* If we trust AW2 to have AW1 unlocked, then we trust AW2 to load AW1's
  SSH private key into memory and use it to connect to the Application
  and Monitor Servers, in order to upload AW2's own SSH public key.
* In other words, each Admin Workstation has its own keypair to allow
  revocation of individual keys, not because a given Admin Workstation
  or its owner cannot be trusted to have access to another Admin
  Workstation's full keypair (in a procedure in which, in fact, they *do*
  have such access).

…e copying options.

…rage copy options.