Modify the libcheri-sandbox ABI, shifting the code entry point from 0x1000
to 0x8000, making room for a new "sandbox metadata page".  Use this data
structure to pass in information such as the heap base and length, rather
than register arguments from the caller on invoke.  This allows the sandbox
to get this information in a trustworthy way from libcheri (the class)
rather than a potentially untrusted caller.

Improve defensiveness of libcheri invoke code: clear MIPS argument registers
after CReturn to reduce dependence on the compiler being correct.  Similar
changes are also required for capability registers on return, and in the
sandboxed code to improve support for mutual distrust (at measurable cost).