vm/appvm: forbid changing template if the are children DispVMs
vm/appvm: forbid changing template if the are children DispVMs

Changing AppVM's template will not update root volume reference in
DispVMs based on it. For now forbid such change.

Fixes QubesOS/qubes-issues#3576

marmarek/qubes-core-admin,QubesOS/qubes-core-admin,marmarek/qubes-core-admin,QubesOS/qubes-core-admin,QubesOS/qubes-core-admin,marmarek/qubes-core-admin