PCI pass-through support

In Qubes OS running a video source in dom0 is not supported. Instead, Qubes OS expects that cameras will be passed through to a virtual machine. The VM has no access to the Converged Security Engine (CSE), so IPU firmware authentication fails and nothing works. This was reported as QubesOS/qubes-issues#8716, but closed because running a closed-source blob in dom0 will never be supported.

An alternative solution is to load and authenticate the firmware in dom0 before assigning the device to a virtual machine. This requires that the ISYS and PSYS not share an IOMMU group with any other PCI device (except perhaps each other) and also requires that the driver ignore failures to load and authenticate firmware if firmware has already been loaded and authenticated.