rng: restrict passthrough names to known-good files

There is some controversy[1] on the qemu list on whether qemu should
have ever allowed arbitrary file name passthrough, or whether it
should be restricted to JUST /dev/random and /dev/hwrng.  It is
always easier to add support for additional filenames than it is
to remove support for something once released, so this patch
restricts libvirt 1.0.3 (where the virtio-random backend was first
supported) to just the two uncontroversial names, letting us defer
to a later date any decision on whether supporting arbitrary files
makes sense. Additionally, since qemu 1.4 does NOT support
/dev/fdset/nnn fd passthrough for the backend, limiting to just
two known names means that we don't get tempted to try fd
passthrough where it won't work.

[1]https://lists.gnu.org/archive/html/qemu-devel/2013-03/threads.html#00023

* src/conf/domain_conf.c (virDomainRNGDefParseXML): Only allow
/dev/random and /dev/hwrng.
* docs/schemas/domaincommon.rng: Flag invalid files.
* docs/formatdomain.html.in (elementsRng): Document this.
* tests/qemuxml2argvdata/qemuxml2argv-virtio-rng-random.args:
Update test to match.
* tests/qemuxml2argvdata/qemuxml2argv-virtio-rng-random.xml:
Likewise.

docs/formatdomain.html.in

@@ -4310,7 +4310,8 @@ qemu-kvm -net nic,model=? /dev/null
           <code>model</code> attribute. Supported source models are:
         </p>
         <ul>
-          <li>'random' &mdash; /dev/random (default) or similar device as source</li>
+          <li>'random' &mdash; /dev/random (default) or /dev/hwrng
+            device as source (for now, no other sources are permitted)</li>
           <li>'egd' &mdash; a EGD protocol backend</li>
         </ul>
       </dd>