multikernel: support isolated SR-IOV VF assignment

[nickolaev]

Multikernel instances currently lack a complete PCI ownership model. A spawned
x86 kernel needs enough platform and device state to enumerate its assigned
device without exposing or disturbing devices retained by the primary kernel.

This series adds end-to-end assignment of an SR-IOV VF to a spawned kernel while
the primary retains the PF.

The series:

1. Adds PCI devices, BARs, and host-bridge information to each Multikernel instance.
2. Transfers and restores the x86 ECAM configuration needed by the secondary.
3. Exposes only assigned PCI devices to the secondary and restores their identity and BARs.
4. Keeps the secondary’s LAPIC timer active when the primary owns the platform timer.

The resulting ownership model is:

• the primary kernel retains the PF;
• the secondary sees only its assigned VF;
• VF identity and BAR resources survive the handoff;
• config accesses to unassigned functions do not reach hardware; and
• Multikernel-specific policy remains outside the generic PCI probe path.

This work can be demonstrated using the main branch here https://codeberg.org/nickolaev/multikernel/src/branch/main .
It was not tested on real hardware, only with qemu-system-x86_64.