CP-312187: Allow VMs to restrict PXE boot protocols

[GeraldEV]

This PR is an updated version of #7312 where the restriction was applied at the network level, it has been changed to apply at the VM/template level.

This improvement is from a customer request to avoid network boot using disabled internet protocols specifically on UEFI VMs.
It is expected the VM sits on a single network which holds the protocol limitation but this cannot be guaranteed, so we restrict the VM which can be easily templated to apply across many VMs with finer control.

The Toolstack will populate a XenStore entry before the VM boots which the virtual firmware will read to determine if a boot device/protocol is valid.
In XenServer, the firmware will assume the protocol is enabled unless it can; access XenStore, determine the XenStore entry for the protocol exists, read the entry, confirm the entry is exactly "false".
Along with populating the default value on create/upgrade; this will ensure there is no change in behaviour until a user opts into the feature.

The code in this PR was Co-authored by claude using the Sonnet 5 model

---

Fresh install/upgraded:

# xe vm-list uuid=<uuid> params=all
<snip>
                 pxe-dhcp-ipv4-allowed ( RW): true
                 pxe-dhcp-ipv6-allowed ( RW): true

Changing the value:

# xe vm-param-set uuid=425c249c-7499-c59d-01c0-cd749d34fd5d pxe-dhcp-ipv6-allowed=false

# xe vm-list uuid=<uuid> params=all
<snip>
                 pxe-dhcp-ipv4-allowed ( RW): true
                 pxe-dhcp-ipv6-allowed ( RW): false

XenStore is correctly populated:

# xenstore-ls /local/domain/6/dhcp
allow-ipv4 = "true"
allow-ipv6 = "false"

[cplaursen]

Everything looks good with the code, but I haven't been able to verify that writing those keys to xenstore will indeed disallow ipv4/ipv6 boot. Could you point me to where that is documented?

[GeraldEV]

Everything looks good with the code, but I haven't been able to verify that writing those keys to xenstore will indeed disallow ipv4/ipv6 boot. Could you point me to where that is documented?

The behaviour is enforced by the firmware of the VM, for XenServer that's edk2 (OVMF)
Our current implementation is in a patch queue and not yet upstreamed, I'll send you a link to the patch and the internal docs