Run virtual machines inside a sandbox with /dev/kvm

New sandboxes on current-generation hosts boot a guest kernel with KVM and expose /dev/kvm to every user in the sandbox, so QEMU, Firecracker or an Android emulator runs with hardware acceleration instead of emulation. A VM inside a sandbox keeps running through pause and resume, and is carried into snapshots and forks. To check whether a sandbox has it, run test -c /dev/kvm && echo yes. Sandboxes created before this change keep their kernel until they are recreated.