amd64: Protect the kernel text, data, and BSS by setting the RW/NX bits
correctly for the data contained on each memory page.

There are several components to this change:

• Add a variable to indicate the start of the R/W portion of the initial memory.
• Stop detecting NX bit support for each AP. Instead, use the value from the BSP and, if supported, activate the feature on the other APs just before loading the correct page table. (Functionally, we already assume that the BSP and all APs had the same support or lack of support for the NX bit.)
• Set the RW and NX bits correctly for the kernel text, data, and BSS (subject to some caveats below).
• Ensure DDB can write to memory when necessary (such as to set a breakpoint).
• Ensure GDB can write to memory when necessary (such as to set a breakpoint). For this purpose, add new MD functions gdb_begin_write() and gdb_end_write() which the GDB support code can call before and after writing to memory.

This change is not comprehensive:

• It doesn't do anything to protect modules.
• It doesn't do anything for kernel memory allocated after the kernel starts running.
• In order to avoid excessive memory inefficiency, it may let multiple types of data share a 2M page, and assigns the most permissions needed for data on that page.

Reviewed by: jhb, kib
Discussed with: emaste
MFC after: 2 weeks
Sponsored by: Netflix
Differential Revision: https://reviews.freebsd.org/D14282