Make KVM ioctl(2) seccomp filter use non-negative FD as arg[0] on ARM.

We have a test that enforces this now, and it fails on ARM due to this.

PiperOrigin-RevId: 609811953

pkg/sentry/platform/kvm/filters_arm64.go

@@ -28,7 +28,7 @@ import (
 func (*KVM) archSyscallFilters() seccomp.SyscallRules {
 	return seccomp.MakeSyscallRules(map[uintptr]seccomp.SyscallRule{
 		unix.SYS_IOCTL: seccomp.PerArg{
-			seccomp.AnyValue{},
+			seccomp.NonNegativeFD{},
 			seccomp.EqualTo(KVM_SET_VCPU_EVENTS),
 		},
 	})