target-s390x: Pass S390CPU to s390_{add,del}_running_cpu()

This prepares for moving the halted field to CPUState.
Most call sites can already supply S390CPU, for some env becomes unused.

Signed-off-by: Andreas Färber <afaerber@suse.de>