Reduce the scope of device exposure on allocation

At the start of this prototype, all DRM/DRI devices are exposed on
allocation because ROCm/HSA/compute applications always access the
hardware via /dev/kfd and there are no isolation between GPUs via
/dev/kfd.  This patch reduces the scope of /dev/dri to only requested
card(s) such that, for non-compute applications (applications that only
uses /dev/dri/card# and /dev/dri/renderD###), access to other GPUs are
blocked.