arm64: Move the FEAT_PAN check later

We only need to enable PAN (Privileged access never) before userspace
is running. Before that there are no unprivileged mappings to protect
the kernel from accessing.

While here switch to use get_kernel_reg to handle the case some CPUs
have FEAT_PAN, while some don't.

Reviewed by: emaste
Sponsored by: Arm Ltd
Differential Revision: https://reviews.freebsd.org/D52576