Delete messages when their self-destruct timers expire (no UI)

This branch implements automatic deletion of private messages and attachments. The sender starts the timer for a private message when it's acked; the recipient starts the timer when the private message is read.

When an attachment is received, we check whether it's listed as an attachment by any private message received in the conversation so far. If not, an orphan cleanup timer with a duration of 28 days is started. The timer is stopped if we receive a private message that lists the attachment; otherwise the orphaned attachment is deleted.

Manual deletion of private messages with missing attachments is now allowed; the orphan cleanup timer will ensure any attachments that arrive after their private messages have been deleted will eventually be deleted too. Making this change was easier than updating the attachment format to indicate whether each attachment belongs to a private message with a self-destruct timer, and I think it improves the manual deletion feature.

This branch also contains an unrelated change: moving ConversationManagerImpl to the conversation package (like its interface). I can move this change to a separate MR if preferred.

The default timer duration is changed to 1 minute for easier testing; we should revert this before merging the feature branch.

Part of #1833 (closed).

Was WIP because the UI isn't updated when messages are deleted. @grote let's discuss whether to merge this to the feature branch and add the UI changes separately, or add them before merging this MR. We also need to update the onboarding text to explain that the recipient's timer starts when the message is read.