nvpassthrough: bind every PCI function of a GPU, not just the first auxiliary one

[jjacobelli]

Follow-up to NVIDIA/k8s-driver-manager#254.

Problem

VFIO assigns an entire IOMMU group to a guest and refuses the group unless every
device in it is bound to a vfio driver or to no driver at all. A discrete NVIDIA
GPU is a multi-function PCI device: .0 VGA/3D, .1 HDMI audio, and on
Turing-era boards .2 (VirtualLink USB xHCI) and .3 (USB-C UCSI).

getGraphicsAuxDev() could not find all of those:

• it returned on the first match, so at most one auxiliary function was ever bound;
• it discovered functions only via consumer:pci: device links. The HDA audio
  function creates one, but the VirtualLink xHCI and USB-C UCSI functions do not,
  so they were structurally invisible;
• it returned early unless the device was PCIVgaControllerClass, so a GPU
  enumerating as a 3D controller (0x030200) got no auxiliary handling at all.

In practice this leaves xhci_hcd owning .2. The IOMMU group is then not
viable and passthrough fails with vfio: group N is not viable.

Fix

Replace it with getAuxDevices(), which returns every other function of the same
physical card. Functions are discovered both by enumerating siblings that share a
domain:bus:device and by following consumer links; the two sets are unioned and
de-duplicated.

Siblings are scoped to the physical card rather than to the IOMMU group
deliberately: where ACS is unavailable a group can span a whole root port, and
unrelated devices must not be unbound from their drivers. A vendor check against
nvpci.PCINvidiaVendorID guards against touching anything that is not an NVIDIA
function.

BindToVFIODriver() and Unbind() now iterate over all of them.

getAuxDevices() takes the devices root as a parameter so the discovery logic is
testable against a fake sysfs tree.

Tests

Adds table-driven tests for the discovery logic covering multi-function boards,
single-function GPUs, foreign-vendor siblings, devices on other slots, class
handling (VGA / 3D controller / NVSwitch), and the de-duplication of a function
reachable both as a sibling and via a consumer link. A second test asserts the
currently-bound driver is reported per function, which is what lets
BindToVFIODriver() skip functions already on the vfio driver.

make assert-fmt goimports vet check-vendor and go test ./pkg/nvpassthrough/
pass; no dependency or vendor changes.