Implement Nvidia GPU isolation w/o filesystem isolation enabled.

The Nvidia GPU isolator will need to use the device cgroup to restrict access to GPU resources, and will need to recover this information after agent failover. For now this will require that the operator specifies the GPU devices via a flag.

To handle filesystem isolation requires that we provide mechanisms for operators to inject volumes with the necessary libraries into all containers using GPU resources, we'll tackle this in a separate ticket.