Refactor security and guest-agents config

- Move guest-agents from hypervisor modifier to independent optional feature
- Merge guest-agents/gui.ks into base.ks
- Remove security from required, add optional security modifier with off option
- Fix hypervisor-type modifier key normalization (underscore→hyphen)
- Add expand_variants() to handle list values in manifest
- Update all tests and expected recipes

fragments/initial-setup/desktop/config.ks

@@ -1 +1,9 @@
 # Desktop initial-setup configuration
+
+firstboot --enable # Enable the Setup Agent to start at boot time
+
+%packages --exclude-weakdeps
+
+initial-setup
+
+%end

fragments/initial-setup/desktop/packages.ks

@@ -1,7 +0,0 @@
-# Initial setup packages - desktop mode
-
-%packages --exclude-weakdeps # Beginning of the packages section. Excludes weak package dependencies.
-
-initial-setup # Initial setup package
-
-%end # End of the packages section