Address code review: fix setter exposure and narrow catch blocks

1. network.rpc.use_xmlrpc and network.rpc.use_jsonrpc: change from
   CMD2_VAR_BOOL_U (getter+setter both safe) to CMD2_VAR_BOOL_U_GET
   (getter safe, setter trusted-only). Untrusted callers could
   previously disable RPC transports entirely.

2. Remove broad catch(std::exception&) and catch(...) from xmlrpc_c.cc
   that masked real defects and altered fault semantics.

3. Revert SCGI callback catch-all to re-throw instead of swallowing
   exceptions with a generic error response.

src/rpc/scgi_task.cc

@@ -3,7 +3,6 @@
 #include "rpc/scgi_task.h"
 
 #include <cstdio>
-#include <cstring>
 #include <unistd.h>
 #include <vector>
 #include <sys/types.h>
@@ -316,17 +315,7 @@ SCgiTask::receive_call(const char* buffer, uint32_t length) {
                     });
       } catch (...) {
         rpc::RpcManager::set_trusted(true);
-
-        // Send a generic error response instead of re-throwing, as the
-        // callback infrastructure may not support exception propagation.
-        const char* err_xml = "<?xml version=\"1.0\"?><methodResponse><fault><value><struct>"
-                              "<member><name>faultCode</name><value><i8>-500</i8></value></member>"
-                              "<member><name>faultString</name><value><string>Internal error</string></value></member>"
-                              "</struct></value></fault></methodResponse>";
-        const char* err_json = "{\"jsonrpc\":\"2.0\",\"error\":{\"code\":-32603,\"message\":\"Internal error\"},\"id\":null}";
-        const char* err = (rpc_type == RpcManager::RPCType::JSON) ? err_json : err_xml;
-        result_callback(err, std::strlen(err));
-        return;
+        throw;
       }
 
       rpc::RpcManager::set_trusted(true);