user/qemu: [CVE] bump to 4.2.0 (#121)

* SSH block device support is dropped until we ship libssh (upstream
  switched away from libssh2)
* system-ppcemb target dropped upstream
* Switched to user/libslirp (4.2.0) instead of vendored copy (4.1.0)
  which fixes several CVEs (included in these secfixes for this time
  only; future secfixes for libslirp should be in user/libslirp with a
  rebuild of qemu for the statically linked bits).