Make handling of mmap()'s prot argument more strict.

• Make the system call fail if prot contains bits other than read, write and exec.
• Similar to OpenBSD's W^X, don't allow write and exec to be set at the same time. I'd like to see for now what happens if we enforce this policy unconditionally. If it turns out that this is far too strict, we'll loosen this requirement.