base: fix dangling session pointers in rm_session

If page faults are handled concurrently (as for base-nova) the traverse lookup
call in rm_session_component must be thread safe, which it isn't.
If the faulting area is backed by nested dataspaces which are managed by
various rm_sessions then a race happens under following circumstances
(triggered occasionally by the bomb test).

The traverse lookup may return a pointer to a rm_session of a nested dataspace.
If the rm_session is in parallel subject to destruction it happened that faults
got enqueued to the faulters list of the deleted rm_session and internally to
a list of the current rm_session of the Rm_client.

During destruction of the faulting Rm_client the associated rm_session will
be dissolved from the Rm_client, which leads to dereferencing the
dangling pointer of the already destructed rm_session.

On base-nova the memory of the rm_session object get unmapped eventually, so
that the de-referencing of the dangling pointer caused page faults in core.

The memory on other kernels inside core never get unmapped so that the
bug doesn't trigger visible faults.

The patch replace the keeping of a rm_session pointer by a keeping a
capability instead. The rm_session object must be looked up now explicitly in
the Object_pool implementation, which implements proper reference counting on
the rm_session object.
base: keep lock during destruction in rm_session

Fixes various spurious page faults. The rm_session_component lock taken during
destruction has been untaken and taken at various places, probably to avoid
deadlocks. Unfortunately the Rm_client objects, also subject to destruction,
can be and has been obtained during this short period by other
threads running in parallel. Later the Rm_client object became deleted and the
pointers to the objects became invalid.

Fixes #549
base: fix deadlock in rm_session destruction path

First make the clients inaccessible and dissolve them from the entrypoint. If
this isn't the first step the clients may be obtained again between
the unlock and lock steps in the destructor.

The dissolve function of the entrypoint makes sure that all in-flight
page-faults of the clients are finished. The dissolve must be called
(on base-nova) without holding the rm_session lock since base-nova makes a
cleanup IPC to the Rm_client object which may try to obtain the vary same lock.
nova: fix cleanup handling in server object

As first step the rpc object must be freed up so that the kernel object
(portal) vanishes. Then the object must be removed from the internal object
pool list so that the object can't be obtained anymore. And then the cleanup
call can be performed (_leave_server_object) since now all names to the
rpc_object are gone.

Doing it in different order (as before the commit) there is a very very little
chance (but the bomb test triggers it occasionally) that the rpc_object can be
obtained again by an incoming IPC - even it is already scheduled for removal.
nova: fix pager cleanup handling

The cleanup call must be performed already during the _dissolve function
shortly after the object at the cap_session is freed up. Otherwise there
is the chance that an in-flight IPC will find the to be dissolved function
again.

Bomb test triggered the case, that a already dissolved rpc_object was found
by a in-flight IPC. If the rpc_object was already freed up by alloc->destroy
the thread using this stale rpc_object pointer cause page-faults in core.
base: reset pager cap in cpu_session
nova: increase number of available cap indexes

Noux test requires some more indexes. We don't free all up because of a missing
reference counting implementation of indexes in base-nova.
base: fix deadlock in core_env on base-nova

During a ram_session->free call in 'core' the lock in core_env.h is taken.
Then in the ram_session::_free_ds implementation the dissolve function for the
dataspace is called. base-nova tries to make sure that the ds is not
accessible anymore by any kind of parallel incoming IPC by performing a
cleanup IPC. Unfortunately the dataspace_session implementation uses the very
same allocator in 'core' and may require to obtain the same lock as taken in
ram_session->free. This leads to a spurious deadlock on base-nova.

The actual free_ds implementation is mostly thread safe, since all used objects
inside there are already locked. The only missing piece is the _payload
variable. By atomically changing the _payload variable there is no need anymore
to lock the whole ram_session->free call which avoids the deadlock on
base-nova.
nova: use experimental nova kernel branch

issue #394
nova: optimize unmap path

Directly unmap memory range instead of looking first it up and then unmap it.