ANDROID: gki_defconfig: Ensure KVM is configured in "protected" mode

In order to support the Protected KVM (pKVM) development effort, ensure
that the GKI kernel initialises KVM in "protected" mode when booted at
EL2, even if the underlying CPU hardware supports VHE.

This has no impact on platforms entering the kernel at EL1.

Cc: David Brazdil <dbrazdil@google.com>
Cc: Marc Zyngier <mzyngier@google.com>
Cc: Alistair Delva <adelva@google.com>
Signed-off-by: Will Deacon <willdeacon@google.com>
Bug: 17809838
Test: atest VirtualizationHostTestCases on an EL2-enabled device
Change-Id: Id84d0b0d08706658d1fc080c09ad8ee5b51ed517