fix(vrtManager): request values are not written into XPath expressions

Four lookups built XPath expressions from values that come from
requests (CodeQL py/xpath-injection, plus get_capabilities, which
CodeQL did not flag; the pages are for superusers):

- The architecture in the create wizard's URLs went into
  arch[@name='...'] in get_emulator, get_machine_types and
  get_capabilities: "nope' or '1'='1" matched every architecture. It is
  now an XPath variable ($arch), which is never parsed as XPath.
- Network filter rules were found with a predicate built from the
  posted action, direction and priority: a quote raised SyntaxError (an
  error page). The rule is now found by comparing its attributes.
- unset_qos put the posted direction into the path, so "*" removed
  every bandwidth setting. It accepts inbound and outbound, as set_qos
  does; the network page shows an error for anything else.

No other XPath in vrtManager is built from a value; the remaining
expressions are constants. The tests fail on the previous code.

vrtManager/connection.py

@@ -410,7 +410,7 @@ class wvmConnect(object):
 
         def guests(ctx):
             result = dict()
-            for arch_el in ctx.xpath("/capabilities/guest/arch[@name='{}']".format(arch)):
+            for arch_el in ctx.xpath("/capabilities/guest/arch[@name=$arch]", arch=arch):
                 result["wordsize"] = arch_el.find("wordsize").text
                 result["emulator"] = arch_el.find("emulator").text
                 result["domain"] = [v for v in arch_el.xpath("domain/@type")]
@@ -625,7 +625,12 @@ class wvmConnect(object):
         """
         :return: emulator list
         """
-        return util.get_xml_path(self.get_cap_xml(), "/capabilities/guest/arch[@name='{}']/emulator".format(arch))
+        # arch comes from the URL: an XPath variable, not part of the expression
+        def emulator(ctx):
+            found = ctx.xpath("/capabilities/guest/arch[@name=$arch]/emulator", arch=arch)
+            return found[0].text if found else None
+
+        return util.get_xml_path(self.get_cap_xml(), func=emulator)
 
     def get_machine_types(self, arch):
         """
@@ -634,9 +639,9 @@ class wvmConnect(object):
 
         def machines(ctx):
             result = list()
-            canonical_name = ctx.xpath("/capabilities/guest/arch[@name='{}']/machine[@canonical]".format(arch))
+            canonical_name = ctx.xpath("/capabilities/guest/arch[@name=$arch]/machine[@canonical]", arch=arch)
             if not canonical_name:
-                canonical_name = ctx.xpath("/capabilities/guest/arch[@name='{}']/machine".format(arch))
+                canonical_name = ctx.xpath("/capabilities/guest/arch[@name=$arch]/machine", arch=arch)
             for archi in canonical_name:
                 result.append(archi.text)
             return result