disable secureboot, bump QEMU machine to 7.2, add netboot.iso and CDROM device, enable KVM hidden state