Add PA-VM shutdown script, reading the API key from conf/

stop-pa-vm.service calls the PAN-OS XML API on host shutdown so the firewall
VM goes down cleanly rather than being killed.

The API key is read from conf/pa-vm.conf, resolved relative to the script.
See conf/pa-vm.conf.example.

Pass the request through curl --config on stdin with the key in an X-PAN-KEY
header, instead of embedding it in the URL. A key in the query string is
visible in ps and would be recorded in any proxy or webserver log along the
path.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

systemd-system/stop-pa-vm.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Stop PA-VM via XML API
+
+[Service]
+Type=oneshot
+RemainAfterExit=true
+ExecStop=/opt/ergosteur/pa-vm_api_stop.sh
+
+[Install]
+WantedBy=multi-user.target