Allow sandboxed containers to use KVM

### Description

Some workloads that one wants to sandbox themselves create virtual machines using KVM. Ideally, gVisor would support this.

### Is this feature related to a specific bug?

No.

### Do you have a specific solution in mind?

gVisor could expose a mediated `/dev/kvm` into the container, with strict validation to ensure that `/dev/kvm` is only used in valid ways.