vmm: Add privilege checks to vmmctl operations

[markj]

Summary

In preparation for supporting creation of VMs by unprivileged users, add
some restrictions:

• Disallow creation of non-transient VMs by unprivileged users. That is, if an unprivileged user creates a VM, the VM must be destroyed automatically once the last fd referencing it is gone.
• Disallow destroying VMs created by a different user, unless the caller has the PRIV_VMM_DESTROY privilege.