Make VM GPU device optional

[simondeziel]

The VM GPU device is not always needed and having it enabled comes with additional memory overhead and bigger attack surface. Being able to easily disable it would make it simple to pack more VMs on any given host.

The bigger attack surface is probably due to GPUs being complex beast which lead to hypervisor-escapes in the past (https://census-labs.com/media/straightouttavmware-wp.pdf).

[tomponline]

@simondeziel is this a known security issue in QEMU 8.1?

[simondeziel]

@tomponline no, this is just to highlight that vGPU comes with additional attack surface and memory usage that'd be nice to make optional.