Improve the IOMMU tests

The IOMMU pre-install tests just check that the kernel has enabled an IOMMU. However, there's no checking of which devices are assigned to each domain.

The checks should make sure that externally accessible or easily accessible internal ports that are DMA capable are protected by one of the domains (eg, Thunderbolt ports, M.2 slots etc). It may even be possible to ascertain that IOMMU support isn't a hard requirement.

Microsoft have some documentation that explains how ACPI tables detail which ports are external facing: https://learn.microsoft.com/en-us/windows-hardware/drivers/pci/dsd-for-pcie-root-ports#identifying-externally-exposed-pcie-root-ports