[savme]

Refuses shell sessions that ask for a terminal on classes that don't declare execTerminal, and hides the portal's shell button there. Unikernel exec runs with no PTY, so -it and the portal shell would open a shell with no prompt, echo or signals. Sessions without a terminal keep working.

• Admission: spec.terminal: true requires the class to declare execTerminal
• Portal: canShowShell checks execTerminal instead of exec, since the portal only opens terminal sessions
• datumctl: a terminal refusal keeps admission's reason and adds "Run the command without -t"

Merge only after #648 is released and general-purpose declares execTerminal in every environment. Otherwise kata loses interactive shells.

Part of datum-cloud/unikraft-provider#247