Set badvaddr on instruction page faults

This supports distinguishing the EPC (the address of the first byte of the
faulting instruction) from the address of the page fault (potentially some
bytes later).
Support 2/4/6/8-byte instructions

Most of the complexity is in instruction address translation, since
instructions may span page boundaries.
zero-extend 32b instructions for vxcptaux