base: fix deadlock in rm_session destruction path

First make the clients inaccessible and dissolve them from the entrypoint. If
this isn't the first step the clients may be obtained again between
the unlock and lock steps in the destructor.

The dissolve function of the entrypoint makes sure that all in-flight
page-faults of the clients are finished. The dissolve must be called
(on base-nova) without holding the rm_session lock since base-nova makes a
cleanup IPC to the Rm_client object which may try to obtain the vary same lock.
nova: fix cleanup handling in server object

As first step the rpc object must be freed up so that the kernel object
(portal) vanishes. Then the object must be removed from the internal object
pool list so that the object can't be obtained anymore. And then the cleanup
call can be performed (_leave_server_object) since now all names to the
rpc_object are gone.

Doing it in different order (as before the commit) there is a very very little
chance (but the bomb test triggers it occasionally) that the rpc_object can be
obtained again by an incoming IPC - even it is already scheduled for removal.
nova: fix pager cleanup handling

The cleanup call must be performed already during the _dissolve function
shortly after the object at the cap_session is freed up. Otherwise there
is the chance that an in-flight IPC will find the to be dissolved function
again.

Bomb test triggered the case, that a already dissolved rpc_object was found
by a in-flight IPC. If the rpc_object was already freed up by alloc->destroy
the thread using this stale rpc_object pointer cause page-faults in core.
base: reset pager cap in cpu_session
nova: increase number of available cap indexes

Noux test requires some more indexes. We don't free all up because of a missing
reference counting implementation of indexes in base-nova.
base: fix deadlock in core_env on base-nova

During a ram_session->free call in 'core' the lock in core_env.h is taken.
Then in the ram_session::_free_ds implementation the dissolve function for the
dataspace is called. base-nova tries to make sure that the ds is not
accessible anymore by any kind of parallel incoming IPC by performing a
cleanup IPC. Unfortunately the dataspace_session implementation uses the very
same allocator in 'core' and may require to obtain the same lock as taken in
ram_session->free. This leads to a spurious deadlock on base-nova.

The actual free_ds implementation is mostly thread safe, since all used objects
inside there are already locked. The only missing piece is the _payload
variable. By atomically changing the _payload variable there is no need anymore
to lock the whole ram_session->free call which avoids the deadlock on
base-nova.
nova: use experimental nova kernel branch

issue #394
nova: optimize unmap path

Directly unmap memory range instead of looking first it up and then unmap it.