vfs: don't accidentally trash mappings when adjusting permissions in MemoryMappedFile::setPermissions
libload: move mprotect() to after relocation, so program headers that will be mapped read-only for the process can be modified by the loader.