fix(instances): a new VM and each clone get a VNC password of their own

Since the VM create became a job (6f0c7300) every new VM was defined with
no VNC password, and a clone copied its source's password (or its lack
of one) exactly: every clone of a template shared it. Computes listen
for VNC on all their addresses (dev/libvirt-bootstrap.sh), so anyone who
could reach a compute's VNC ports opened any of these consoles directly,
without the panel; the README's firewall rule was the only guard.

The create job asks for create.py's random 8-character password again,
and a clone's VNC graphics get a new random one. The console page sends
the password to a user with passwordless_console, which the user create
form now ticks by default next to change_password; a user without it is
asked for the password, as the permission intends. Existing VMs keep
their settings.

Live create, clone and VM page tests pass on a TCP compute.

admin/forms.py

@@ -6,6 +6,7 @@ from django.contrib.auth import password_validation
 from django.contrib.auth.forms import AdminPasswordChangeForm
 from django.contrib.auth.models import Group, User
 from django.core.exceptions import ValidationError
+from django.db.models import Q
 from django.utils.translation import gettext_lazy as _
 
 from accounts.forms import UniqueEmailMixin
@@ -124,9 +125,11 @@ class UserCreateForm(UserForm):
 
     def __init__(self, *args, **kwargs):
         super().__init__(*args, **kwargs)
-        # New users may change their own password unless unticked here
+        # New users may change their own password and open their VMs' consoles
+        # (whose VNC password the console page sends) unless unticked here
         self.fields["user_permissions"].initial = Permission.objects.filter(
-            content_type__app_label="accounts", codename="change_password"
+            Q(content_type__app_label="accounts", codename="change_password")
+            | Q(content_type__app_label="instances", codename="passwordless_console")
         )
 
     def clean(self):