Prevent agents (PEM + kelvin) from accessing cgroup directories they … #153

Job	Run time
env-protect-setup	6s
authorize	3s
get-dev-image / get-image	6s
generate-matrix	7m 31s
code-coverage	2m 23s
build-and-test (Clang opt + UI, nokvm, --config=clang --compilation_mode=opt, bazel_buildables_cl...	6m 45s
build-and-test (Clang debug, nokvm, --config=clang --compilation_mode=dbg, bazel_buildables_clang...	5m 20s
build-and-test (ASAN, nokvm, --config=asan --compilation_mode=dbg, bazel_buildables_sanitizer, ba...	5m 11s
build-and-test (BPF opt (4.14.254), kvm, --config=qemu-bpf --compilation_mode=opt --//bazel/test_...	5m 23s
build-and-test (BPF opt (6.1.106), kvm, --config=qemu-bpf --compilation_mode=opt --//bazel/test_r...	5m 47s
build-and-test (Go race detector, nokvm, --config=go_race --compilation_mode=opt, bazel_buildable...	6m 13s
build-and-test (TSAN, nokvm, --config=tsan --compilation_mode=dbg, bazel_buildables_sanitizer, ba...	4m 56s
build-and-test (GCC opt, nokvm, --config=gcc --compilation_mode=opt, bazel_buildables_gcc_opt, ba...	4m 43s
build-and-test-status	3s
	54m 30s

Provide feedback