Actually set the "no execute" bit on 1 MB page mappings in pmap_protect().
Previously, the "no execute" bit was being set directly in the PTE, instead
of the local variable in which the new PTE value is being constructed.  So,
when the local variable was finally assigned to the PTE, the "no execute"
bit setting was lost.