fix(console): disable the unauthenticated serial console by default

socketiod does not validate the console token, keeps a single global PTY
and broadcasts its output to every connected client, so anyone who can
reach port 6081 can read and write a serial console that someone opened.
It is also broken for legitimate users, since console/views.py now writes
signed tokens that socketiod cannot parse.

Until it is rewritten, turn the serial console off by default:

- Add SERIAL_CONSOLE_ENABLED = False to the settings template; installs
  whose settings.py lacks it are treated as disabled.
- The console view shows an error instead of the xterm page for pty
  consoles while the setting is off.
- socketiod refuses to start unless SERIAL_CONSOLE_ENABLED is True.
- Supervisor: autostart=false for socketiod; drop -d (debug) from the
  supervisor and systemd definitions; fix the systemd unit description;
  conf/systemd/install.sh no longer suggests enabling socketiod.
- README: stop opening port 6081 and document how to enable the serial
  console on a trusted network.

webvirtcloud/settings.py.template

@@ -218,6 +218,12 @@ WS_PUBLIC_PATH = "novncd/"
 # Websock Certificate for SSL
 WS_CERT = None
 
+# Serial console (xterm.js over socketiod). Disabled by default: socketiod does
+# not authenticate connections yet, so anyone who can reach SOCKETIO_PORT can
+# read and write an open serial console. Only enable it on a trusted network,
+# and also start the socketiod service (autostart=false in the supervisor config).
+SERIAL_CONSOLE_ENABLED = False
+
 SOCKETIO_PORT = 6081
 SOCKETIO_HOST = "0.0.0.0"