libct/cg/sd: set the DeviceAllow property before DevicePolicy #7227

Job	Run time
cross-i386	59s
test (ubuntu-20.04, 1.22.x, rootless, -race)	7m 4s
test (ubuntu-20.04, 1.22.x, rootless)	6m 50s
test (ubuntu-20.04, 1.22.x, -race)	7m 47s
test (ubuntu-20.04, 1.22.x)	7m 9s
test (ubuntu-20.04, 1.23.x, rootless, -race)	7m 0s
test (ubuntu-20.04, 1.23.x, rootless)	6m 54s
test (ubuntu-20.04, 1.23.x, -race)	8m 0s
test (ubuntu-20.04, 1.23.x)	7m 0s
test (ubuntu-20.04, 1.23.x, criu-dev)	7m 40s
test (ubuntu-24.04, 1.22.x, rootless, -race)	9m 58s
test (ubuntu-24.04, 1.22.x, rootless)	9m 8s
test (ubuntu-24.04, 1.22.x, -race)	7m 29s
test (ubuntu-24.04, 1.22.x)	6m 53s
test (ubuntu-24.04, 1.23.x, rootless, -race)	9m 52s
test (ubuntu-24.04, 1.23.x, rootless)	10m 57s
test (ubuntu-24.04, 1.23.x, -race)	8m 17s
test (ubuntu-24.04, 1.23.x)	7m 12s
test (ubuntu-24.04, 1.23.x, criu-dev)	7m 53s
test (actuated-arm64-6cpu-8gb, 1.23.x, rootless)	11m 32s
test (actuated-arm64-6cpu-8gb, 1.23.x)	7m 49s
all-done	1s
	2h 43m 24s

Provide feedback