fix: add an authorization matrix test and close the endpoints it finds

Add webvirtcloud/test_authorization_matrix.py, which walks every named URL
and checks that a user without any VM/compute relation only reaches an
explicit allowlist, and that the global view_instances permission does not
open consoles. It found:

- /computes/<id>/... views without any check (compute_graph,
  get_compute_*, get_dom_capabilities, storages.get_volumes): the whole
  computes URL namespace is now wrapped with superuser_only, so a view
  added there later cannot be exposed by a missing decorator.
- guess_mac_address (leaks dhcpd.conf host/MAC pairs), random_mac_address
  and guess_clone_name: superuser-only, like the buttons that use them.
- check_instance: cross-tenant VM name lookup with no caller; removed.
- getvvfile and get_vdi_url: reachable with only view_instances, and the
  .vv file contains the VNC password.

Console access now follows one rule, instances.utils.can_open_console:
an active superuser or an active owner of the VM. The global
view_instances permission is read-only. It is used by the console page,
novncd, getvvfile and get_vdi_url (getvvfile and the VDI tab are kept for
virt-viewer users). The console page answers 403 instead of 500 when
access is denied, with the same answer for a missing VM.

console/tests.py

@@ -154,11 +154,13 @@ class ConsoleViewsTestCase(TestCase):
         response = self.client.get(url)
 
         # Non-permitted user attempting to view other user's instance
-        self.assertEqual(response.status_code, 500)
+        self.assertEqual(response.status_code, 403)
         self.assertIn("permission", response.content.decode("utf-8").lower())
 
     @patch("console.views.wvmInstance")
-    def test_console_user_with_view_instances_perm(self, mock_wvm):
+    def test_console_view_instances_perm_does_not_open_console(self, mock_wvm):
+        # ROADMAP S-09: global view_instances is a read-only role; the console
+        # is for superusers and VM owners only.
         mock_conn = MagicMock()
         mock_conn.get_console_type.return_value = "vnc"
         mock_conn.get_console_websocket_port.return_value = None
@@ -171,7 +173,8 @@ class ConsoleViewsTestCase(TestCase):
         url = reverse("console") + f"?token={self.token}"
         response = self.client.get(url)
 
-        self.assertEqual(response.status_code, 200)
+        self.assertEqual(response.status_code, 403)
+        self.assertTemplateNotUsed(response, "console-vnc-lite.html")
 
     @patch("console.views.wvmInstance")
     @override_settings(WS_PUBLIC_PATH="/novncd/")
@@ -522,6 +525,25 @@ class NovncdDaemonLogicTestCase(TestCase):
         with self.assertRaises(PermissionError):
             novncd_mod.get_connection_infos(token)
 
+    def test_get_connection_infos_view_instances_user_is_not_enough(self):
+        User = get_user_model()
+        viewer = User.objects.create_user(username="novnc_viewer", password="password")
+        viewer.user_permissions.add(Permission.objects.get(codename="view_instances"))
+        compute = Compute.objects.create(
+            name="novnc-viewer-compute", hostname="127.0.0.1", login="root", password="", type=1
+        )
+        instance = Instance.objects.create(
+            compute=compute,
+            name="novnc-viewer-vm",
+            uuid="55555555-5555-5555-5555-555555555555",
+        )
+
+        signer = TimestampSigner(salt="console.novnc")
+        token = signer.sign(f"{compute.id}:{instance.uuid}:{viewer.id}")
+
+        with self.assertRaises(PermissionError):
+            novncd_mod.get_connection_infos(token)
+
     def test_get_connection_infos_inactive_user(self):
         User = get_user_model()
         inactive_user = User.objects.create_user(