Apply a custom Firecracker CPU template via /cpu-config to mask a specific x86_64 CPUID feature bit from the guest

Documented steps

1. Write your template as JSON: kvm_capabilities (optional, can negate with '!'), cpuid_modifiers for x86_64 leaves, msr_modifiers for MSRs
2. Each cpuid_modifier references a leaf/subleaf and a register (eax/ebx/ecx/edx) with a bitmap where 1=force bit on, x=leave unchanged, 0=force bit off — e.g. leaf 0x1 subleaf 0x0 register eax with bitmap '0bxxxx000000000011xx00011011110010'
3. Send it before boot: curl --unix-socket /tmp/firecracker.socket -X PUT http://localhost/cpu-config -H 'Content-Type: application/json' -d @template.json
4. Note bitmaps can be contracted (e.g. 0b101) with implied leading 'x' bits, and '_' is allowed as a visual separator
5. Start the microVM only after PUT /cpu-config succeeds, then verify guests observe the intended feature mask