amd64: do not enable PKRU if user disabled saving PKRU register in xsave mask

This is done by reverting CR4_PKE bit, because we perform %CR4
initialization in initializecpu(), and the function is called before
xsave_mask is read. To not redo the whole early initialization
sequence for the corner case, this should be good enough.

Reported by: jhb
Reviewed by: jhb, markj
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D38219