fix(vrtManager): request values are not written into XPath expressions

Four lookups built XPath expressions from values that come from
requests (CodeQL py/xpath-injection, plus get_capabilities, which
CodeQL did not flag; the pages are for superusers):

- The architecture in the create wizard's URLs went into
  arch[@name='...'] in get_emulator, get_machine_types and
  get_capabilities: "nope' or '1'='1" matched every architecture. It is
  now an XPath variable ($arch), which is never parsed as XPath.
- Network filter rules were found with a predicate built from the
  posted action, direction and priority: a quote raised SyntaxError (an
  error page). The rule is now found by comparing its attributes.
- unset_qos put the posted direction into the path, so "*" removed
  every bandwidth setting. It accepts inbound and outbound, as set_qos
  does; the network page shows an error for anything else.

No other XPath in vrtManager is built from a value; the remaining
expressions are constants. The tests fail on the previous code.

networks/views.py

@@ -258,7 +258,11 @@ def network(request, compute_id, pool):
             return HttpResponseRedirect(request.get_full_path())
         if "unset_qos" in request.POST:
             qos_dir = request.POST.get("qos_direction", "")
-            conn.unset_qos(qos_dir)
+            try:
+                conn.unset_qos(qos_dir)
+            except ValueError as err:
+                messages.error(request, err)
+                return HttpResponseRedirect(request.get_full_path())
 
             if conn.is_active():
                 messages.success(