add utility header for writing invariant checks

They all vanish under NDEBUG, and produce hideous bloat when not.
mapdb: add distribute_children(), call from split_entry()

discontiguate() and split_entry() gained a @db context parameter for
distribute_children()'s benefit.
mapdb: split mapdb_add_map() by case

Though the case where old entries are larger or smaller still remains.
mapdb: implement case #4 of mapdb_add_map()

And identify case #5, left unimplemented until something runs into it.
mapdb: add child-to-parent invariant checking

This already finds a problem despite being so fresh.
mapdb: add reparent_children(), support code

This version is sadly as broken as the mapdb spec as of this changeset, i.e.
mostly, but will get better. There's also a big comment about error handling
at its call site.

For support code, add get_map_db(), which blows a BUG_ON() when the ref_id
isn't found. The check could likely just be an assert too.
mapdb: extend invariant checks

First, as an opportunistic change, check that each map_entry has non-zero
access rights. If the mask is zero, they're supposed to have been removed
already. (also add a few more context lines.)

Second, move the child refs check into an optional segment, disabled with a
parameter to check_mapdb(). The flag is set by the trailing invariant check in
mapdb_add_map(), as it leaves child references up to the caller.
mapdb: account for parent ref in merge_entries()

The preceding or succeeding map_entry will only be considered if its parent
space is the same space as the current one, and if the address referenced is
appropriately contiguous; or if neither @parent nor other->parent is defined.
mapdb: strengthen map_entry's definition

Namely, mention the "parent greater than child" rule, cases where @parent is
REF_INVALID(), and how @range == L4_nilpage makes the structure undefined.
mapdb: remove parent_offset from deref_child() output

That field's meaning was unclear anyhow.

Call sites were adjusted accordingly, which led to addition of two panic()
calls to mapdb.c, both indicating a FIXME: one in the distribute_children()
case where a child should be discontiguated so that it'll no longer violate
the single parent rule, and the other in the mapdb_unmap_fpage() complex case.
mapdb: account for parent refs in coalesce_entries()

I.e. don't merge buddies that don't refer to adjacent addresses in the parent
space.
mapdb: call coalesce_entries() from reparent_children()

This changeset was noted to be overly conservative because coalesce_entries()
could produce a larger child entry than its parent, fixed in a later
changeset.
mapdb: set parent in merge_entries() succ case

The pred case retains the old parent reference.

Also a change to what dump_map_group() prints.
mapdb: add new child references in split_entry()
mapdb: maintain child-parent size invariant in distribute_children()

This was the complex case that wasn't implemented. The prototype, which
doesn't handle out-of-memory conditions, is quite simple.
mapdb: limit to parent size in coalesce_entries()

This changeset had no test case.
mapdb: rewrite Unmap recursion into children

The properly optimized version of this function is only the interface for IPC:
that should call a mapdb_unmap_entry() which takes a map_entry pointer and an
access mask rather than the fpage.
mapdb: minor cleanups