createVat should take bundlecap, not bundle

[warner]

What is the Problem Being Solved?

To support #3269 and moving large bundle objects out of userspace messages, we need the vatAdminService's createVat() to take a bundlecap instead of an actual bundle.

We might want a transition period in which createVat() accepts either a bundlecap or a bundle, while we track down the code that still passes in a bundle. I expect that only swingset unit tests do this: I think Zoe uses createVatByName (see #4374).

Description of the Design

For now, the createVat() method should accept a bundlecap, use D(bundlecap).getBundleID() to fetch the bundleID, then pass the bundleID to devices.vatAdmin, which can pass it along to the kernel endowment. Internally, the kernel vat-creation code can then look up the bundle by ID.

Later, I'd like to avoid having the bundleID exposed in userspace, even if it's vatAdmin. I think this will require an additional entrypoint on devices.bundle that the kernel can call to convert the bundlecap into a bundleID. OTOH, that would also require going through the device's clist to convert the bundlecap's kref into a vref that the device can look up. So I might defer this step for a while, until/unless bundlecaps acquire first-class representation within the kernel (e.g. kbNN?).

Security Considerations

Test Plan

unit tests