Make space for a system-object reference in the per-sandbox metadata
area.  Initialise this during object instantiation.  When the object
constructors run, propagate it into libc_cheri's cheri_system_stub.

Since we are now always delegating a system-object reference, impose
some access control on use of its methods through a set of flags that
are specified at sandbox-instantiation time.  The three current
permissions are for console output (putc/puts/printf), allocation and
freeing of global memory, and access to user hooks.

This will allow us to avoid having to pass system-object references
in via explicit method invocations in many places.
Update cheritest and cheritest-helper.bin to no longer pass explicit
CHERI system-object references across CCall; instead, rely on the
implied reference delegated during sandbox instantiation.