Add towncrier for automatic changelog generation (#10379)

blast from the past! resurrects
https://github.com/certbot/certbot/pull/9803 with all of @bmw's changes.
i figured instead of force-pushing a basically brand new branch and
obliterating the old review, i'd just start from a clean slate

fixes #8272

---------

Co-authored-by: Brad Warren <bmw@users.noreply.github.com>
Co-authored-by: Brad Warren <bmw@eff.org>

tools/_release.sh

@@ -82,7 +82,7 @@ tmpvenv=$(mktemp -d)
 python3 -m venv "$tmpvenv"
 . $tmpvenv/bin/activate
 # update packaging tools to their pinned versions
-tools/pip_install.py virtualenv
+tools/pip_install.py towncrier virtualenv
 
 root_without_le="$version.$$"
 root="$RELEASE_DIR/le.$root_without_le"
@@ -96,9 +96,9 @@ if [ "$RELEASE_BRANCH" != "candidate-$version" ] ; then
 fi
 git checkout "$RELEASE_BRANCH"
 
-# Update changelog
-sed -i "0,/main/ s/main/$(date +'%Y-%m-%d')/" certbot/CHANGELOG.md
-git add certbot/CHANGELOG.md
+# Update changelog. `--yes` automatically clears out older newsfragments,
+# and all of towncrier's changes are staged for commit when it's done
+towncrier build --version "$version" --yes
 git commit -m "Update changelog for $version release"
 
 for pkg_dir in $SUBPKGS certbot-compatibility-test
@@ -205,18 +205,6 @@ git tag --local-user "$RELEASE_GPG_KEY" --sign --message "Release $version" "$ta
 git rm --cached -r "$built_package_dir"
 git commit -m "Remove built packages from git"
 
-# Add main section to CHANGELOG.md
-header=$(head -n 4 certbot/CHANGELOG.md)
-body=$(sed s/nextversion/$nextversion/ tools/_changelog_top.txt)
-footer=$(tail -n +5 certbot/CHANGELOG.md)
-echo "$header
-
-$body
-
-$footer" > certbot/CHANGELOG.md
-git add certbot/CHANGELOG.md
-git commit -m "Add contents to certbot/CHANGELOG.md for next version"
-
 if [ "$RELEASE_BRANCH" = candidate-"$version" ] ; then
     SetVersion "$nextversion".dev0
     git commit -m "Bump version to $nextversion"