[nel]

Summary

Adds an optional firmware block to libvirt runners for choosing the UEFI firmware explicitly.

By default the template uses <os firmware='efi'>, and libvirt picks the firmware. On Ubuntu 26.04 it picks a Secure Boot build with Microsoft keys enrolled (OVMF_CODE_4M.ms.fd). Guests that load test-signed drivers need Secure Boot off. Asking libvirt's automatic choice for firmware without Secure Boot picked OVMF.amdsev.fd on that host, which AppArmor (virt-aa-helper) then refused, so the domain did not start.

libvirt:
  path: /var/lib/libvirt/images/windows.qcow2
  firmware:
    path: /usr/share/OVMF/OVMF_CODE_4M.fd       # UEFI firmware image
    vars_path: /usr/share/OVMF/OVMF_VARS_4M.fd  # its variables template

• Both fields are required when firmware is set; config loading rejects one without the other.
• Each VM gets its own copy of the variables file at <overlay>.fd, beside its <overlay>.qcow2. It is removed with the overlay on stop, on orphan cleanup and when startup fails.
• Without firmware, the template keeps firmware='efi' and behaves as before.
• Documented in the configuration reference.

This PR touches the same lines as #47 (both add a field to LibvirtImage and the template parameters); whichever merges second needs a small rebase, which I'll do.

Closes #51

Test plan

• Template tests: automatic choice by default; explicit loader and per-VM variables file when set
• Config test: firmware without vars_path is rejected
• make test, golangci-lint run (2.15.0), gofmt -s
• Windows 11 guests on Ubuntu 26.04 / libvirt 12.0.0: Secure Boot off, test signing active, a test-signed kernel driver loads, and no firmware files are left after jobs