Add comments to CHERI permissions to make it slightly easier to eyeball
permission masks coming out the debugger and figure out what they mean.
Centralise the kernel's capability-printing macros; use them for printing
the CHERI stack.
Temporary software workaround for a spec/CPU bug in which untagged
capabilities can trigger local-store exceptions when written to the
global-only sandbox heap.