arm: Port PTE freelist of KVA allocation and maintenance from i386

Using an idea from Stephan Uphoff, use the empty pte's that correspond
to the unused kva in the pv memory block to thread a freelist through.
This allows us to free pages that used to be used for pv entry chunks
since we can now track holes in the kva memory block.

Idea from:  ups
arm: Reclaim pv_entry when we are in a serious low memory condition.

Free some pages so that allocation of another pv_chunk could be possible.
arm: Avoid redundant clearing of the PGA_WRITABLE flag after pmap_nuke_pv()

On pv_entry removal in pmap_nuke_pv(), all corresponding  pv_entries related to
specified vm_page are being checked for write permission and PGA_WRITABLE flag
is cleared if there are no writable mappings or no pv_entries left.
Hence, additional PGA_WRITABLE flag clearing is not necessary.
arm: Use pmap_find_pv if needed instead of multiplying its code throughout pmap.
arm: Fix L2 PTE access permissions management.

Keep following access permissions:

APX     AP     Kernel     User
 1      01       R         N
 1      10       R         R
 0      01      R/W        N
 0      11      R/W       R/W

Avoid using reserved in ARMv6 APX|AP settings:
- In case of unprivileged (user) access without permission to write,
  the access permission bits were being set to reserved for ARMv6
  (but valid for ARMv7) value of APX|AP = 111.

Fix-up faulting userland accesses properly:
- Wrong condition statement in pmap_fault_fixup() caused that
  any genuine, unprivileged access was being fixed-up instead of
  just skip doing anything and return. Staring from now we ensure
  proper reaction for illicit user accesses.
arm: Fix page reference emulation on ARMv6 and v7

In order to invalidate the page for reference emulation purposes
it is necessary to CLEAR the type bits in the page descriptor.
arm: Switch to AP[2:1] access permissions model. Store "referenced" bit in PTE.

Enable Access Flag in CPU control. With AF enabled each valid mapping needs to
have referenced bit in PTE set in order to be able to cache it in the TLB.

AP[0] bit is to be used as reference flag.
All access permissions are encoded by AP[2:1] wherein AP[1] is in fact
"user enable" and AP[2](APX) is "write disable".

All mappings are always set to be valid. Reference emulation is performed by
setting/clearing reference flag in PTE.

md.pvh_attrs are no longer necessary however pv_flags are still being used for
now.

Marking vm_page as "dirty" or "referenced" is being performed on:
- page or flag fault servicing in pmap_fault_fixup(), basing on the fault type
- vm_fault servicing in pmap_enter() according to the desired protections
  and faulty access type
Redundant page marking has been removed as on ARM we know exactly when the
particular page is referenced or is going to be written.