RFC: xen: read entropy from the Xen entropy device

We connect to an entropy server over the well-known console channel

  org.openmirage.entropy.1

Limitations:

- we read exactly one block of entropy data. Should we read as much
  as the backend will offer? Note the backend implementation has a
  rate limiter to avoid starving dom0.
- there is no fall-back for cases where there is no Xen entropy source
  i.e. on the vast majority of Xen hosts including AWS.

Signed-off-by: David Scott <dave.scott@citrix.com>
+1 for letting the app writer specify a policy, and make the default `strict`. baking in a weaker default for something that could be as critical as this seems a bad idea. cf what i understood were a number of the issues with the client api to openssl