agent: Lock down the executable that cockpit-session runs

cockpit-session runs in a different security context (at least
SELinux) than cockpit-ws. So don't trust cockpit-ws to tell us
which agent to run.

Fixes #607
agent: Don't start a session without authentication

Currently the only form of authentication is password based,
but in the future we'll pass gssapi kerberos input to
cockpit-session for authentication.
agent: Use cockpit-agent instead of test-agent

Remove the unnecessary test-agent program, and just use
cockpit-agent during tests.

Closes #807