fix(vrtManager): request values are not written into XPath expressions

Four lookups built XPath expressions from values that come from
requests (CodeQL py/xpath-injection, plus get_capabilities, which
CodeQL did not flag; the pages are for superusers):

- The architecture in the create wizard's URLs went into
  arch[@name='...'] in get_emulator, get_machine_types and
  get_capabilities: "nope' or '1'='1" matched every architecture. It is
  now an XPath variable ($arch), which is never parsed as XPath.
- Network filter rules were found with a predicate built from the
  posted action, direction and priority: a quote raised SyntaxError (an
  error page). The rule is now found by comparing its attributes.
- unset_qos put the posted direction into the path, so "*" removed
  every bandwidth setting. It accepts inbound and outbound, as set_qos
  does; the network page shows an error for anything else.

No other XPath in vrtManager is built from a value; the remaining
expressions are constants. The tests fail on the previous code.

vrtManager/network.py

@@ -379,6 +379,9 @@ class wvmNetwork(wvmConnect):
         self.wvm.networkDefineXML(new_xml)
 
     def unset_qos(self, direction):
+        # direction goes into the XPath below
+        if direction not in ("inbound", "outbound"):
+            raise ValueError("Direction must be inbound or outbound")
         tree = etree.fromstring(self._XMLDesc(0))
         for direct in tree.xpath(f"/network/bandwidth/{direction}"):
             parent = direct.getparent()