Add some more checking to the page fault handler.

[markj]

Summary

• Rename "lower" to "usermode" to make its meaning more clear. I am happy to revert this part if there is some reason "lower" is a better name, but I don't see one.
• Panic immediately if witness says we're holding non-sleepable locks. This helps ensure that we don't recurse on the pmap lock in pmap_fault_fixup().
• Panic if the kernel faults on a user address without setting an onfault handler.
• Panic if the fault occurred in a critical section or interrupt handler, like we do on other platforms.
• Use VM_MAX_USER_ADDRESS instead of checking the high bit in the fault address. I think the previous trick is too magical and makes it harder to change the address space layout if or when we decide to do so (e.g., switching to SV48).
• Fix a few style issues.