CP-9227: Safeguard against malicious suspend images

During VM.resume, as part of Domain.restore in Xenopsd, when a Qemu record in
the suspend image is detected, the header is parsed (with a length) and then
this number of bytes is written out to a file in dom0's filesystem to be passed
to Qemu.

This patch:
* Catches any error that may occur when writing the file for qemu.
* Puts some sanity checks when parsing the length in the Qemu record header.
  This should be large enough that we won't need to change it if/when we
  upgrade Qemu to future versions but small enough to avoid a DoS. Qemu save
  records are currently around 7-8k. We have chosen to read a max of 1M and
  raise an exception if we parse a suspend image that claims to have a Qemu
  record bigger than this.

Signed-off-by: Rob Hoes <rob.hoes@citrix.com>