enable missing PCI/IOMMU features in zone kernels

[kaniini]

Presently our zone kernels do not provide everything needed to build the nvidia driver. So we wind up using a host kernel image instead with them.

[kaniini]

@azenla IMO we probably want a kernel variant that allows these surfaces that normal zone kernels do not, for additional security hardening through surface reduction. What do you think?