Bug 1520824: add kvm device

[walac]

When enabled, it exposes /dev/kvm to the container, allowing to run
emulators with hardware virtualization support.

[djmitche]

Looks good. Two questions:

• Do we want to be able to control access to this feature on a per-worker-pool basis? I think we do that for privileged?
• It looks like this would allow concurrent tasks to both talk to /dev/kvm - is that true, and intended?

[walac]

Do we want to be able to control access to this feature on a per-worker-pool basis? I think we do that for privileged?

/dev/kvm doesn't have security implications according to my research

It looks like this would allow concurrent tasks to both talk to /dev/kvm - is that true, and intended?

It causes no harm it being shared, afaik. Furthermore, it is implemented for one specific use case.