Store ssh host keys in libvirt domain xml
Move ssh insecure testing to ssh function

Move the insecure test back to the ssh function, so that the ssh
function may conditionally permit secure access if the guest's host key
is available.

This adds an internal exception to pass back to the caller, so that the
caller may provide the user with a more helpful error message or
warning depending on the situation.

Tests updated. Since the test doesn't really care about the "insecure"
testing functionality, it can safely just request insecure mode all the
time and verify that this is what was requested. Then it can be
independent of whether the guest's host key is available.
Use the guest's ssh public host key when available