virtio_mmio: Fix feature negotiation copy-paste issue in r361943

This caused us to write to the low half of the feature word twice, once with
the high bits and once with the low bits. Common legacy device implementations
seem to be fairly lenient about being able to write to the feature bits
multiple times, but Arm's models use a stricter implementation that will ignore
the second write. This fixes using vtnet(4) on those models.

Reported by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Pointy hat: jrtc27