Prevent agents (PEM + kelvin) from accessing cgroup directories they … #2985

Job	Run time
env-protect-setup	7s
authorize	3s
get-dev-image / get-image	5s
generate-matrix	2m 30s
code-coverage	32m 20s
clang-tidy	22m 53s
build-and-test (GCC opt, nokvm, --config=gcc --compilation_mode=opt, bazel_buildables_gcc_opt, ba...	22m 15s
build-and-test (BPF opt (6.1.106), kvm, --config=qemu-bpf --compilation_mode=opt --//bazel/test_r...	33m 2s
build-and-test (Clang opt + UI, nokvm, --config=clang --compilation_mode=opt, bazel_buildables_cl...	24m 5s
build-and-test (TSAN, nokvm, --config=tsan --compilation_mode=dbg, bazel_buildables_sanitizer, ba...	29m 15s
build-and-test (BPF opt (4.14.254), kvm, --config=qemu-bpf --compilation_mode=opt --//bazel/test_...	29m 17s
build-and-test (ASAN, nokvm, --config=asan --compilation_mode=dbg, bazel_buildables_sanitizer, ba...	50m 59s
build-and-test (Clang debug, nokvm, --config=clang --compilation_mode=dbg, bazel_buildables_clang...	28m 8s
build-and-test (Go race detector, nokvm, --config=go_race --compilation_mode=opt, bazel_buildable...	11m 44s
build-and-test-status	3s
	4h 46m 46s

Provide feedback