Fix fault_type handling in vm_map_lookup().

[markj]

Summary

Suppose that the map entry is wired, so that we later assign
fault_type = entry->protection. Suppose further that we jump back to
RetryLookup. Then fault_type will no longer contain the original
fault protection mask.

I think this is mostly harmless from a correctness standpoint. We end
up with a fault_type that is a superset of its correct value. We may
trigger a copy-on-write update to the entry while handling a read fault,
or we may end up returning KERN_PROTECTION_FAILURE for a fault that
should have succeeded if the entry protections change while the map lock
was dropped.

Submitted by: Wuyang Chung <[e-mail]>