KVM: nVMX: Don't leak L1 MMIO regions to L2