ANDROID: KVM: arm64: Handle permission faults for non-protected guests

pKVM proactively maps non-protected guest pages with RWX permissions for
simplicity reason. But now that we have available the right helpers to
relax permissions of np-guest stage-2 PTEs, we can align the behaviour
with non-protected KVM by initially mapping pages with restricted
permissions and relaxing in response to permission faults.

This means we can tolerate using page-cache pages to back non-protected
guests as we can correctly track whenever they get dirtied.

Bug: 227300338
Bug: 278749606
Change-Id: I742f1ca0b982a290ca3de400f99b4ee1ebd8f2cc
Signed-off-by: Quentin Perret <qperret@google.com>