Backport of Fix DevicesSets being removed when cpusets are reloaded with cgroup v2 into release/1.3.x

[hc-github-team-nomad-core]

Backport

This PR is auto-generated from #17535 to be assessed for backporting due to the inclusion of the label backport/1.3.x.

The below text is copied from the body of the original PR.

---

This meant that if any allocation was created or removed, all active DevicesSets were removed from all cgroups of all tasks.

This was most noticeable with "exec" and "raw_exec", as it meant they no longer had access to /dev files.

Fixes #12877, and possibly a bunch of other related but different reports in the issue tracker. See #12877 (comment) for steps how to reproduce this problem, and validate it is actually fixed with this change. Most important piece of context: https://github.com/opencontainers/runc/blob/5cf9bb229feed19a767cbfdf9702f6487341e29e/libcontainer/cgroups/devices/v2.go#L55-L57

Few warnings:

• 4 hours ago I had no idea how cgroups worked, nor how BPF and DevicesSets interacted with cgroups
• 1 hour ago I never touched a Go project in my life (but a long history of other languages, so "its fine")

PS: I checked if there were any e2e tests this could be part of; but it seems there is nothing there yet, neither for cgroup or cpuset. If I missed it, please let me know.