Allow children in cnfvar templates

Allow children in cnfvar templates

Some templates are not just lists of cnfvars, but contain elements that
required child cnfvars (e.g. the upcomping VPNCONN_WG_LOCAL_NET).
However, a CnfVar's "children" attribute cannot be set in the CnfVar
constructor, nor are there mechanisms to do that in other functions that
create CnfVars. Add functionality for this special case of creating
CnfVars from templates, where values are very-well controlled. Use dicts
to specify the children.

Also warn if naive users specify overwrite parameters including the "name"
like "VPNCONN_PROTO" (should only be "proto=...")