vtd: do FLR before xc.domain_destroy()

vtd: do FLR before xc.domain_destroy()

When we "xm destroy" a guest with assigned devices, in
xen/common/domain.c:domain_kill(), we relinquish guest's memory first,
then invoke domain_destroy() -> complete_domain_destroy() ->
arch_domain_destroy() -> pci_release_devices()/iommu_domain_destroy().

Between relinquish_memory() and domain_destroy(), a device may be
issuing DMA request and access guest's relinquished  memory.

We can do_FLR() to quiesce devices before xc.domain_destroy().

Signed-off-by: Dexuan Cui <dexuan.cui@intel.com>