[RFE] support nova proxy <-> hypervisor VNC/SPICE traffic encryption

[Dmitrii Shcherbakov]

Currently if TLS termination is enabled for API it only provides security for client <-> proxy connectivity.

Some improvements for that were implemented for Queens but require configuration.

https://specs.openstack.org/openstack/nova-specs/specs/ocata/approved/websocket-proxy-to-host-security.html
https://blueprints.launchpad.net/nova/+spec/websocket-proxy-to-host-security

[Trent Lloyd (lathiat)]

When implementing this feature, the optional support for AUTHENTICATION using x509 client certificates should also be implemented.

Right now, the VNC port is both unencrypted and unauthenticated - anyone with network access to the compute node can connect to the VNC port and get console access. Even with encryption on, they can still do that just with an encrypted connection.

Authorization should be configured to ensure that only an authorized nova-cloud-controller novncproxy can connect to the nova-compute VNC port.