feat add implementation of options to reduce attack surface

Closes #1722

adds '--paranoid' option (also triggered by setting QUICKEMU_PARANOID in the environment ). Also individual config file toggles are available for :
 - usb_redir="false"
 - usb_ccid="false"
 - folder_sharing="false"
 - ssh_fwd="false"

These default to "true"  to retain the current behaviour.

Author: philclifford