KVM: Update cr8 intercept when APIC TPR is changed by userspace