Run nvidia-modprobe -u if necessary

Liam Middlebrook at NVIDIA reports that Vulkan ray-tracing support does not work reliably from inside the pressure-vessel container.

One reason why not is that we import libcuda.so.1 into the container's library search path in terms of its SONAME libcuda.so.1, but the ray-tracing initialization actually dlopens libcuda.so.455.46.02 or similar, which we don't provide. This is fixed in NVIDIA's latest beta drivers (which now dlopen libcuda.so.1 instead, or as a fallback, or something) so I'm not intending to do anything more on this particular topic in pressure-vessel.

A second reason is that libcuda.so.1 relies on being able to run the setuid binary nvidia-modprobe to load the nvidia_uvm.ko kernel module. This can't work in the container, for two reasons:

• we don't have nvidia-modprobe;
• even if we did, the fact that it's setuid would not be effective, because we have PR_SET_NO_NEW_PRIVS and we don't have CAP_SYS_MODULE in our capability bounding set.

We could bypass this problem by running nvidia-modprobe -u before entering the container environment.