fix(instances): a new VM and each clone get a VNC password of their own

Since the VM create became a job (6f0c7300) every new VM was defined with
no VNC password, and a clone copied its source's password (or its lack
of one) exactly: every clone of a template shared it. Computes listen
for VNC on all their addresses (dev/libvirt-bootstrap.sh), so anyone who
could reach a compute's VNC ports opened any of these consoles directly,
without the panel; the README's firewall rule was the only guard.

The create job asks for create.py's random 8-character password again,
and a clone's VNC graphics get a new random one. The console page sends
the password to a user with passwordless_console, which the user create
form now ticks by default next to change_password; a user without it is
asked for the password, as the permission intends. Existing VMs keep
their settings.

Live create, clone and VM page tests pass on a TCP compute.

admin/tests/test_user_create.py

@@ -1,6 +1,8 @@
 """Creating a user in the admin pages: the password reaches the database only
 hashed, and the configured password validators apply as on the change forms."""
 
+import re
+
 from django.contrib.auth.models import Group, Permission, User
 from django.db import connection
 from django.test import TestCase, override_settings
@@ -36,6 +38,12 @@ class UserCreateTests(TestCase):
         self.assertEqual(written, [])
         self.assertTrue(User.objects.get(username="newbie").check_password(RAW))
 
+    def test_a_new_user_may_change_the_password_and_open_consoles_unless_unticked(self):
+        # new VMs have a VNC password, which the console page sends only with passwordless_console
+        page = self.client.get(reverse("admin:user_create")).content.decode()
+        ticked = set(re.findall(r'<input[^>]*name="user_permissions"[^>]*value="(\d+)"[^>]*checked', page))
+        self.assertEqual(ticked, {str(self.change_password.pk), str(Permission.objects.get(codename="passwordless_console").pk)})
+
     def test_groups_and_permissions_are_saved(self):
         group = Group.objects.create(name="uc-group")
         self.create(groups=[group.pk], user_permissions=[self.change_password.pk])