Disable rdrand policy from vm domain

The rdrand instruction is apparently broken on some Ryzen 3000 CPUs.
This issue is supposed to be fixed by BIOS update, but that's not
available for all boards yet. As a workaround we are disabling the
rdrand policy so the VM can start on those systems.

- https://bugzilla.redhat.com/show_bug.cgi?id=1806532

constants.go

@@ -19,7 +19,9 @@ const (
   <memory unit='MB'>{{ .Memory }}</memory>
   <vcpu placement='static'>{{ .CPU }}</vcpu>
   <features><acpi/><apic/><pae/></features>
-  <cpu mode='host-passthrough'></cpu>
+  <cpu mode='host-passthrough'>
+    <feature policy="disable" name="rdrand"/>
+  </cpu>
   <os>
     <type arch='x86_64'>hvm</type>
     <boot dev='hd'/>