Improve cgroup v2 device support

[Furisto]

Solve all FIXMEs

• Add tests for bpf examples
• Clarify if we should start with deny all
• Clarify order in which rules should be applied
• Check if we should use BPF_F_REPLACE
• Figure out best way to test device controller
• Should we follow runc's implementation for emulator

cc: @MoZhonghua

[Furisto]

@MoZhonghua I cannot assign you...weird

[tsturzl]

I don't think they're yet considered a "contributor" by github since I don't think they've had anything merged into main yet.

[MoZhonghua]

I don't think they're yet considered a "contributor" by github since I don't think they've had anything merged into main yet.

This pr created by me has been merged into master, so I don't know why this happans.

@Furisto You can assign task to me in comments, and fix this later

[yihuaf]

@MoZhonghua I cannot assign you...weird

Now it works :)

[MoZhonghua]

@Furisto I think it's better to assign this issue to you, I'll be busy with work and don't have many time for this.

[Furisto]

@MoZhonghua Sorry to hear that. Please feel free to contribute again when you have more time.

[utam0k]

@Furisto I know you have already learned a lot about it from runc, but what do you think about this issue?

[utam0k]

@Furisto May I ask you to let me know the status?