octeontx2-af: Block VFs from clobbering special CGX PKIND state (CVE-2026-74527) | HOL Guard CVE