zones should be created with dtrace_user and dtrace_proc privileges

Currently, our zones are created without the dtrace_user and dtrace_proc privileges. We probably want to create all zones with dtrace_user and dtrace_proc -- and we probably want to strongly consider granting dtrace_kernel to the switch zone. Untested diffs:

diff --git a/sled-agent/src/services.rs b/sled-agent/src/services.rs
index a9000a1c4..42bdc103f 100644
--- a/sled-agent/src/services.rs
+++ b/sled-agent/src/services.rs
@@ -1258,14 +1258,20 @@ impl ServiceManager {
     }
 
     // Check the services intended to run in the zone to determine whether any
-    // additional privileges need to be enabled for the zone.
+    // additional privileges need to be enabled for the zone. (Note that we
+    // grant every zone the dtrace_user and dtrace_proc privileges.)
     fn privs_needed(zone_args: &ZoneArgs<'_>) -> Vec<String> {
-        let mut needed = Vec::new();
+        let mut needed = vec![
+            "default".to_string(),
+            "dtrace_user".to_string(),
+            "dtrace_proc".to_string(),
+        ];
+
         for svc_details in zone_args.sled_local_services() {
             match svc_details {
                 SwitchService::Tfport { .. } => {
-                    needed.push("default".to_string());
                     needed.push("sys_dl_config".to_string());
+                    needed.push("dtrace_kernel".to_string());
                 }
                 _ => (),
             }
@@ -1275,7 +1281,6 @@ impl ServiceManager {
             match omicron_zone_type {
                 OmicronZoneType::BoundaryNtp { .. }
                 | OmicronZoneType::InternalNtp { .. } => {
-                    needed.push("default".to_string());
                     needed.push("sys_time".to_string());
                     needed.push("proc_priocntl".to_string());
                 }