qemu: Allow setting boot menu on/off

Add a new element to the <os> block:

  <bootmenu enable="yes|no"/>

Which maps to -boot,menu=on|off on the QEMU command line.

I decided to use an explicit 'enable' attribute rather than just make the
bootmenu element boolean. This allows us to treat lack of a bootmenu element
as 'use hypervisor default'.

docs/formatdomain.html.in

@@ -79,6 +79,8 @@
     <type>hvm</type>
     <loader>/usr/lib/xen/boot/hvmloader</loader>
     <boot dev='hd'/>
+    <boot dev='cdrom'/>
+    <bootmenu enable='yes'/>
   </os>
   ...</pre>
 
@@ -104,6 +106,12 @@
         times to setup a priority list of boot devices to try in turn.
         <span class="since">Since 0.1.3</span>
       </dd>
+      <dt><code>bootmenu</code></dt>
+      <dd> Whether or not to enable an interactive boot menu prompt on guest
+      startup. The <code>enable</code> attribute can be either "yes" or "no".
+      If not specified, the hypervisor default is used. <span class="since">
+      Since 0.8.3</span>
+      </dd>
     </dl>
 
     <h4><a name="elementsOSBootloader">Host bootloader</a></h4>

docs/schemas/domain.rng

@@ -122,6 +122,16 @@
             <ref name="osbootdev"/>
           </oneOrMore>
         </choice>
+        <optional>
+          <element name="bootmenu">
+            <attribute name="enable">
+              <choice>
+                <value>yes</value>
+                <value>no</value>
+              </choice>
+            </attribute>
+          </element>
+        </optional>
       </interleave>
     </element>
   </define>