bhyve: support VBTs which lay outside of the OpRegion

Previously, all of our devices had an OpRegion with a VBT which lays inside the
OpRegion. Unfortunately, the OpRegion has a fixed size and VBTs get more and
more features/settings. A VBT can be larger than the allocated space of 6 KB
inside the OpRegion. For larger VBTs, Intel added two fields to the OpRegion to
report the VBT address and the VBT size. Make bhyve aware of those fields and
put the VBT into the guest memory too.

Unfortunately, Intel forgot to consider virtualization when defining OpRegion
v2.0. OpRegion v2.0 uses an absolute address for pointing to the VBT. This
address is useless in a guest environment. It's possible to patch that.
However, it requires some more work and we can't test it because we have no
test device with this combination. Therefore, we don't want to do that yet
until we have a use case. Fortunately, Intel noticed the issue and from v2.1
onwards, the VBT address is a relative address.

Reviewed by: markj
MFC after: 1 week
Sponsored by: Beckhoff Automation GmbH & Co. KG
Differential Revision: https://reviews.freebsd.org/D45337