fix: serve JSON endpoints as application/json and build DOM safely

Several views returned json.dumps() output through HttpResponse, i.e. as
text/html, and guess_mac_address reflects the URL's vname into it
(reflected XSS). Templates filled the log table and volume dropdowns by
concatenating server data into HTML strings, and log messages contain
user-entered snapshot/disk/clone names (stored XSS that runs when a
superuser opens the Logs tab).

- Use JsonResponse in guess_mac_address, random_mac_address,
  guess_clone_name, sshkeys, storages.get_volumes,
  datasource.os_metadata_json and logs.vm_logs; sshkeys?plain=true is
  served as text/plain.
- stats_tab.html builds log rows with .text(); instance.html and
  create_instance_w2.html build <option> elements with .val().text().

datasource/views.py

@@ -1,9 +1,8 @@
-import json
 import socket
 
 from accounts.models import UserInstance, UserSSHKey
 from computes.models import Compute
-from django.http import Http404, HttpResponse
+from django.http import Http404, HttpResponse, JsonResponse
 from django.shortcuts import get_object_or_404, render
 from libvirt import libvirtError
 from vrtManager.instance import wvmInstance
@@ -32,7 +31,7 @@ def os_metadata_json(request, version):
         ip = get_client_ip(request)
         hostname = get_hostname_by_ip(ip)
         response = {"uuid": OS_UUID, "hostname": hostname}
-        return HttpResponse(json.dumps(response))
+        return JsonResponse(response)
     else:
         err = "Invalid version: %(version)s" % {"version": version}
         raise Http404(err)