configs: Add Q35 machine support to QEMU VM

Add required PCI devices to the QEMU config so that it both works with
the default i440FX and the newer Q35 machine. This is transitional until
Q35 gains VT-d support, then we will drop i440FX again.

At this chance, drop the unneeded permission to talk to the first legacy
PIC.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>