scripting: provision macOS guests on first boot

[osy]

Summary

macOS 27 can set up a macOS guest without Setup Assistant: VZMacGuestProvisioningOptions creates the user account and can turn on automatic login and Remote Login. This makes "create a ready-to-use macOS VM" possible for CI and other automation. The guest only reads these options on the first boot after macOS is installed.

• AppleScript: start vm provisioning {full name:"CI", username:"ci", password:"…", automatic login:true, remote login:true}
• utmctl start vm --provision-username ci --provision-password-stdin --provision-auto-login --provision-ssh (also --provision-password and --provision-full-name). Reading the password from standard input keeps it out of the process list, and it is not echoed when typed at a terminal.
• The options include a password, so they are a parameter to a single start and are never written to config.plist or the registry.
• A request that cannot be honoured fails before the VM starts, so the first boot is not used up: not a macOS guest, not the Apple backend, a host older than macOS 27, an install that has not run yet, a saved state, recovery mode, or an account the framework rejects (the new 40001–40003 errors have their own messages).

This is only exposed to scripting because most users will never need it. There is no wizard or settings UI.

Notes for review:

• On main the window controller restarts the guest automatically after an install, which is the first boot. A fully unattended flow therefore needs a scripted install such as scripting: add an install command for macOS guests #7863 (with scripting: allow creating macOS VMs with the Apple backend #7862 to create the VM): create → install → start with provisioning.
• UTMScripting.swift contains only the regenerated start declaration, identical to the bridge-gen.sh output. The rest of the generator's current output is unrelated to this change (lower-cased class names, b'…' four-char-code comments, and members that were never regenerated on main), so it is left for a separate catch-up.
• An older UTM ignores the unknown provisioning parameter and performs a normal start. utmctl ships inside the app bundle so the two stay in step.

Resolves #7757

Testing

Testing: Tested by a human on macOS 27.0 (26A428), Apple Silicon Mac. The author acknowledges that this change has been tested and/or reviewed by a human in accordance with UTM's AI contribution guidelines.

Verified on a fresh macOS 27.0 guest through both AppleScript and utmctl with the password on standard input: the guest boots to the desktop without Setup Assistant, and over SSH the account, full name, administrator rights and automatic login are as requested. Each rejected case fails before the VM starts and leaves it stopped, a saved state survives a rejected request, and the password does not appear in config.plist, the registry, preferences or logs. Starting without provisioning is unchanged for Apple and QEMU VMs.