Use strict validation in DomainXML.get_for_storage()

for extra paranoia.
Limit validation of domain XML for execution

DomainXML.get_for_execution() should be able to produce XML constructs
that are not permitted in imported domain XML.
vmnetx.execute: Consolidate imports
Pass VNC socket address at connect time, not during construction
Connect to VNC server using TCP instead of Unix domain

qemu doesn't support serving SPICE over a Unix domain socket.
Set random password on VNC connection

to reduce the chance of another client connecting to the VNC server and
disconnecting us.