seccomp: vfio: add one policy to allow fcntl
seccomp: vfio: add one policy to allow fcntl

VFIO is updated to use try_clone() to duplicate a File recently.
The try_clone() implementation will use fcntl with the argument
F_DUPFD_CLOEXEC to duplicate the File, so need to add one more
rule in vfio_device.policy to allow it otherwise VFIO will be
failed when sandbox is enabled.

BUG=None
TEST=boot VM with VFIO passthrough + sandbox enabled

Change-Id: I55cce937f1c12a32537aaff8d3ddafa135a674d1
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2816822
Reviewed-by: Daniel Verkamp <72bc170b46ec491f7bdd4359a1c0bfed274de40c@chromium.org>
Tested-by: kokoro <2ac7b1f3fa578934c95181d4272be0d3bca00121@google.com>
Commit-Queue: Daniel Verkamp <72bc170b46ec491f7bdd4359a1c0bfed274de40c@chromium.org>

google/crosvm,google/crosvm,google/crosvm,google/crosvm