aarch64: Save correct value of x18 on trapframe for nested faults

x18 is overwritten with a temporary copy of the kernel stack pointer
when it is saved in the trapframe. This does not matter in terms of
function since nested exception return does not restore x18 from the
trapframe, but it does mean that examining x18 in a debugger in stack
frames above a nested fault outputs the wrong register value.

To fix, compute the value of the original stack pointer to save in x18
later after the trapframe has been constructed.

Reviewed by: jhb, andrew
Sponsored by: AFRL, DARPA
Differential Revision: https://reviews.freebsd.org/D52472

(cherry picked from commit 99213b3c352cdf568ea7cf5b4dddb1879f16a601)