arm64: Move the FEAT_PAN check later

We only need to enable PAN (Privileged access never) before userspace
is running. Before that there are no unprivileged mappings to protect
the kernel from accessing.

While here switch to use get_kernel_reg to handle the case some CPUs
have FEAT_PAN, while some don't.

Reviewed by: emaste
Sponsored by: Arm Ltd
Differential Revision: https://reviews.freebsd.org/D52576

(cherry picked from commit 72828486ca9412f118d7e2316e584cd1cab8c90f)