Do not use legacy distutils.spawn

The whole distutils module is a legacy thing in python3. Specifically,
most of it is not installed in Debian by default (there is only
distutils.version). Depending on python3-distutils is problematic, as
it's availability varies between Debian versions.

Instead of fighting with special cases in dependencies, replace the
whole thing with non-legacy shutil.which() (available since Python 3.3).

debian/control

@@ -40,7 +40,6 @@ Depends:
     util-linux,
     e2fsprogs,
     python3-daemon,
-    python3-distutils,
     python3-qubesdb,
     python3-gi,
     python3-xdg,

qubesagent/firewall.py

@@ -24,8 +24,7 @@ import logging
 import os
 import socket
 import subprocess
-from distutils import spawn
-
+import shutil
 import daemon
 
 import qubesdb
@@ -732,7 +731,7 @@ class NftablesWorker(FirewallWorker):
 
 
 def main():
-    if spawn.find_executable('nft'):
+    if shutil.which('nft'):
         worker = NftablesWorker()
     else:
         worker = IptablesWorker()