fix(gstfsd): only the panel, with the host's key, can change a VM's disk

gstfsd, the root service on each compute that rewrites a shut-off VM's
/etc/shadow and authorized_keys, did what any client on its port asked.
Now it needs GSTFSD_KEY (64 hexadecimal characters, in the unit's
/etc/default/webvirt-gstfsd) and does not start without it. Each
connection gets a new challenge; the panel signs its request for it
with HMAC-SHA256 and gstfsd checks the signature before any change, so
a request recorded on one connection is refused on another. gstfsd
signs its reply for the same challenge and the panel's nonce, and the
panel accepts only that reply.

Each compute has a gstfsd key, the host's GSTFSD_KEY: the compute forms
and the API take it and never show it, and an empty value on an edit
keeps it. The bootstrap script makes the key file once, readable by
root only; the README shows how to make it and where the panel takes
it. The traffic is still not encrypted: a remote panel's port stays
open to the panel's address only.

computes/validators.py

@@ -51,3 +51,10 @@ def validate_migration_address(value):
         if _hostname.fullmatch(value):
             return
     raise ValidationError(_("Enter an IP address or a host name, without a scheme or port"))
+
+
+def validate_gstfsd_key(value):
+    """The key gstfsd on the host signs with: GSTFSD_KEY in its
+    /etc/default/webvirt-gstfsd, 64 lowercase hexadecimal characters."""
+    if not re.fullmatch(r"[0-9a-f]{64}", value):
+        raise ValidationError(_("Enter the 64 hexadecimal characters of GSTFSD_KEY in the host's /etc/default/webvirt-gstfsd"))