Opt-in legacy AMI JAR signatures for sandboxed KVM child

[nesvet]

Summary

AMI MegaRAC JViewer on ASUS ASMB8-iKVM fails in the stock OpenJDK 8u242 child: the AMI code-signing certificate on JViewer.jar is expired and jdk.jar.disabledAlgorithms includes MD5. Without opt-in flags, javaws reports unsigned jars; with legacy allowances enabled in the child, JViewer connects.

This PR adds opt-in, default-off flags gated by child environment variables and optional host-template YAML (allow_legacy_jar_signatures, allow_insecure_jnlp_certs). Default behaviour is unchanged.

docker/Dockerfile_openjdk-8 points stretch apt sources at archive.debian.org so the child image still builds when Debian stretch mirrors are unavailable.

README documents the flags and example YAML only (ASUS EXTRNIP / download_endpoint is documented in #39).

Flags

YAML key	Child env	Effect
allow_legacy_jar_signatures: true	ALLOW_LEGACY_JAR_SIGNATURES=true	Allow MD5 in jdk.jar.disabledAlgorithms
allow_insecure_jnlp_certs: true	ALLOW_INSECURE_JNLP_CERTS=true	IcedTea deployment.security.itw.ignorecertissues

ALLOW_LEGACY_AMI_JARS=true remains supported as a convenience alias for both flags.

Files

• docker/entrypoint.sh — apply JVM / IcedTea settings when flags are set
• docker/Dockerfile_openjdk-8 — stretch archive.debian.org apt sources
• nojava_ipmi_kvm/config.py — parse template YAML keys
• nojava_ipmi_kvm/kvm.py — pass -e into the ephemeral child
• README.md — example YAML and env var reference

Test plan

• Stock child, flags unset: reproduce javaws / weak-signature failure on ASMB8
• Both YAML flags enabled: full JViewer session inside child
• Flags unset on other BMC templates: no regression
• docker build -f docker/Dockerfile_openjdk-8 succeeds on a clean runner

Tested on ASUS ASMB8-iKVM firmware 1.14.2. With flags disabled, failure reproduced. With both YAML keys enabled, noVNC session loads after connect.

Closes #36