x86_64: secure SW contexts

The kernel can legitimately be asked to pop a SW context from VCPD.  If a
syscall (a SW ctx) is in the kernel when a __preempt arrives, that SW ctx will
be saved into VCPD.  If that VC was in vcore context (notifs disabled), then
the kernel will secure and restart it next time that vcore runs (change_to or
__startcore).