Security rule targets are missing the vsys identifier

Describe the bug

The vsys identifier is missing from security rule targets. Only the firewall serial number is returned.

Expected behavior

The target of a security policy should return the virtual system that the rule is targeting in addition to the serial number for multi-vsys firewalls. Example: [ "SERIAL-NO1/vsys2", "SERIAL-NO2/vsys2" ]

Additionally, updating the target of a policy should be able to handle virtual system identifiers in the same format, which is how virtual systems are displayed in the UI.

Current behavior

Only the serial numbers are returned in the target list. Example: ["SERIAL-NO1","SERIAL-NO2"]

Possible solution

Update the parsing of the target parameter to look for the virtual system in the XML. The current VersionedParamPath method does not support looking for children, which is how virtual systems are stored in the target XML of a security policy:

<target>
    <negate>no</negate>
    <devices>
        <entry name="SERIAL-NO1">
            <vsys>
                <entry name="vsys2"/>
            </vsys>
        </entry>
    </devices>
</target>

Steps to reproduce

1. Create new panorama device (PanDevice.create_from_device)
2. Create a new DeviceGroup class and add to panorama device.
3. Create a new PreRulebase class and add to the DeviceGroup.
4. Execute a refreshall (pandevice.policies.SecurityRule.refreshall) to pull in all security policies and loop through rule target values.

Screenshots

None

Context

Issue prevents correctly pulling current rulebase configuration from Panorama and prevents the modification of Ansible modules to deploy a security rule to a specified virtual system of a firewall.

Your Environment

python 3.6.8
pan-python 0.16.0
pandevice 0.14.0
Windows 10

Start with VersionedParamPath and the target handling used by pandevice.policies.SecurityRule.refreshall; reproduce the issue using the documented Panorama and DeviceGroup setup. Inspect the target XML's nested vsys entry and update parsing and serialization so targets use the SERIAL-NO/vsys format for both reads and updates.