feat(console): a working serial console

The xterm console never connected: socketiod expected a different token
format, its worker had no compute credentials, one global console was
shared by every client and its output broadcast to all of them, and the
Docker image did not run socketiod at all.

- console/tokens.py: one authorize() for noVNC and socketiod; the signed
  token is the only credential, checked at connect time.
- socketiod: one pty worker per client (consolecallback with the
  instance id), one session per VM, a session cap, input and resize
  checked; the parent never opens libvirt. The engine.io same-origin
  check is on.
- consolecallback: opens the console with the compute's credentials and
  exits with a message when it cannot.
- Docker runs socketiod as a runit service; nginx proxies /socket.io/
  with Host and the scheme for the origin check. Supervisor and systemd
  start it as well; WEBVIRTCLOUD_SERIAL_CONSOLE=1 enables it.
- Tests: token and session unit tests, socketiod as a process, and a
  live test that reads SeaBIOS from a wvc-test VM on the TCP and SSH
  hosts.

webvirtcloud/settings.py.template

@@ -288,26 +288,16 @@ WS_PUBLIC_PATH = "novncd/"
 # Websock Certificate for SSL
 WS_CERT = None
 
-# Serial console (xterm.js over socketiod). Disabled by default: socketiod does
-# not authenticate connections yet, so anyone who can reach SOCKETIO_PORT can
-# read and write an open serial console. Only enable it on a trusted network,
-# and also start the socketiod service (autostart=false in the supervisor config).
-SERIAL_CONSOLE_ENABLED = False
+# Serial console (xterm.js over socketiod) for VMs without graphics. socketiod
+# accepts only the console page's signed token (as noVNC does); while this is
+# False it refuses every connection. Restart socketiod after changing it.
+SERIAL_CONSOLE_ENABLED = os.getenv("WEBVIRTCLOUD_SERIAL_CONSOLE") == "1"
 
 SOCKETIO_PORT = 6081
-# Listen on localhost only and reach socketiod through the nginx /socket.io/
-# location (set SOCKETIO_PUBLIC_PORT to 80 or 443 then).
+# Listen on localhost only; the console page reaches socketiod through the
+# nginx /socket.io/ location.
 SOCKETIO_HOST = "127.0.0.1"
 
-# Socketio public host
-SOCKETIO_PUBLIC_HOST = None
-
-# Socketio public port - 80 or 443 if reverse-proxy, else 6081
-SOCKETIO_PUBLIC_PORT = 6081
-
-# Socketio public path
-SOCKETIO_PUBLIC_PATH = "socket.io/"
-
 # List of console listen addresses
 QEMU_CONSOLE_LISTENER_ADDRESSES = (
     ("127.0.0.1", _("Localhost")),