CA-85761: distinguish between unguessable uuids and references and those which are merely unique

Everywhere where we make a uuid or reference, decide whether it needs to be unguessable or not. The only things which must be unguessable are session ids (and possibly secrets).

With this change the number of /dev/urandom reads recorded by strace during a migration drops from 680 to 10.

Tested by:
    1. quicktest
    2. xapi restart with no pool secret -- to verify regeneration was ok
    3. adding a "SECURE:" prefix to "Uuid.secure" and checking that sessions were "secure" while VM references were not