KVM: nVMX: Defer APICv updates while L2 is active until L1 is active