Move XVM's locker authorization code into a separate xvm-authz-locker
package (and corresponding xvm.authz.locker Python package).
This makes it possible to install invirt-base without needing the
authz code installed as well, and also separates some very
XVM-specific logic from the Invirt packages.