JIT: implement timer support in mtspr

Faster, of course, since we avoid the interpreter, but also means we can
get more a more accurate timer in long blocks by adding the offset from the
start of the block to the retrieved timer. I don't know if this will actually
fix any issues, but it's more correct and a nearly-free improvement.
Yeah, probably a teeny bit.  (The most important uses of PushRegisters are for slow paths which are only taken conditionally at runtime.)