ANDROID: kvm: pkvm: Set guest state protection flags for pVM

Enable the has_protected_state for the pVM when creates guest. After
returning from the vcpu_run PV interface, set the guest_state_protected
to indicate that the pVM's vcpu state is protected by the pkvm
hypervisor after the vcpu has started running. This is because the host
still pre-configures pVM's vcpu state for booting so the pkvm hypervisor
enforces the protection after that. Once the host doesn't need to do so
then the guest_state_protected flag can be set earlier.

Bug: 391539939
Test: pKVM works
Upstream-Task: 402758258

Change-Id: I920c16edf6492c34c385a215328f807c87e77399
Signed-off-by: Chuanxiao Dong <chuanxiao.dong@intel.com>
Signed-off-by: Dmytro Maluka <dmaluka@google.com>