fix(api): host API checks what the web forms check

- An API volume takes the name and size the web form takes. Its name went
  into the volume XML unchecked, so a name could add elements such as a
  backing store pointing at another VM's disk; the name is also escaped
  there now. A size of 0 and metadata preallocation on a non-qcow2 volume
  are refused or dropped, as on the web form.
- An API compute update with an empty or null password keeps the stored
  one, as the web form does; it emptied it and cut the host off.
- The architectures endpoint answers 404 for an unknown compute instead of
  500; an unrouted copy of it is removed.

vrtManager/storage.py

@@ -332,7 +332,7 @@ class wvmStorage(wvmConnect):
             alloc = 0
         xml = f"""
             <volume>
-                <name>{name}</name>
+                <name>{util.xml_escape(name)}</name>
                 <capacity>{size}</capacity>
                 <allocation>{alloc}</allocation>
                 <target>