nspawn: actually allow access to /dev/net/tun in the container

It's not sufficient to just copy the device node over, we need to update
the policy for it too.