Refactor security and guest-agents config

- Move guest-agents from hypervisor modifier to independent optional feature
- Merge guest-agents/gui.ks into base.ks
- Remove security from required, add optional security modifier with off option
- Fix hypervisor-type modifier key normalization (underscore→hyphen)
- Add expand_variants() to handle list values in manifest
- Update all tests and expected recipes

fragments/guest-agents/base.ks

@@ -1,5 +1,6 @@
-# Guest agents for virtual machines (base)
+# Guest agents for virtual machines
 
 %packages --exclude-weakdeps
 qemu-guest-agent
+spice-vdagent
 %end

fragments/guest-agents/gui.ks

@@ -1,5 +0,0 @@
-# Guest agents for virtual machines (GUI only)
-
-%packages --exclude-weakdeps
-spice-vdagent
-%end