fix(instances): a new VM and each clone get a VNC password of their own

Since the VM create became a job (6f0c7300) every new VM was defined with
no VNC password, and a clone copied its source's password (or its lack
of one) exactly: every clone of a template shared it. Computes listen
for VNC on all their addresses (dev/libvirt-bootstrap.sh), so anyone who
could reach a compute's VNC ports opened any of these consoles directly,
without the panel; the README's firewall rule was the only guard.

The create job asks for create.py's random 8-character password again,
and a clone's VNC graphics get a new random one. The console page sends
the password to a user with passwordless_console, which the user create
form now ticks by default next to change_password; a user without it is
asked for the password, as the permission intends. Existing VMs keep
their settings.

Live create, clone and VM page tests pass on a TCP compute.

admin/forms.py

@@ -6,6 +6,7 @@ from django.contrib.auth import password_validation
 from django.contrib.auth.forms import AdminPasswordChangeForm
 from django.contrib.auth.models import Group, User
 from django.core.exceptions import ValidationError
+from django.db.models import Q
 from django.utils.translation import gettext_lazy as _
 
 from accounts.forms import UniqueEmailMixin
@@ -124,9 +125,11 @@ class UserCreateForm(UserForm):
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
-        # New users may change their own password unless unticked here
+        # New users may change their own password and open their VMs' consoles
+        # (whose VNC password the console page sends) unless unticked here
         self.fields["user_permissions"].initial = Permission.objects.filter(
-            content_type__app_label="accounts", codename="change_password"
+            Q(content_type__app_label="accounts", codename="change_password")
+            | Q(content_type__app_label="instances", codename="passwordless_console")
         )
 
     def clean(self):

admin/tests/test_user_create.py

@@ -1,6 +1,8 @@
 """Creating a user in the admin pages: the password reaches the database only
 hashed, and the configured password validators apply as on the change forms."""
 
+import re
+
 from django.contrib.auth.models import Group, Permission, User
 from django.db import connection
 from django.test import TestCase, override_settings
@@ -36,6 +38,12 @@ class UserCreateTests(TestCase):
         self.assertEqual(written, [])
         self.assertTrue(User.objects.get(username="newbie").check_password(RAW))
 
+    def test_a_new_user_may_change_the_password_and_open_consoles_unless_unticked(self):
+        # new VMs have a VNC password, which the console page sends only with passwordless_console
+        page = self.client.get(reverse("admin:user_create")).content.decode()
+        ticked = set(re.findall(r'<input[^>]*name="user_permissions"[^>]*value="(\d+)"[^>]*checked', page))
+        self.assertEqual(ticked, {str(self.change_password.pk), str(Permission.objects.get(codename="passwordless_console").pk)})
+
     def test_groups_and_permissions_are_saved(self):
         group = Group.objects.create(name="uc-group")
         self.create(groups=[group.pk], user_permissions=[self.change_password.pk])