KVM: arm64: Fix missing ESR_ELx.IL in syndrome injection

Hi folks,

After sashiko caught the missing IL bug [1], I did an audit of all ESR
syndrome construction sites in KVM/arm64 as Marc suggested. This series
is the result of that audit.

The ARM architecture mandates ESR_ELx.IL=1 for several exception
classes regardless of instruction length: EC=Unknown, Instruction
Aborts, Data Aborts with ISV=0, and SError. For FPAC (EC=0x1C), IL
reflects instruction length, but FPAC can only be generated by A64
instructions, so IL must also be 1.

Patch 1 is the bug sashiko found: inject_undef64() in the pKVM hyp (EL2)
path never set IL. Patch 2 makes the same fix to inject_undef64() in the
normal host path, where IL was derived from the triggering trap's
instruction length. No instruction that reaches undef injection has a
16-bit encoding, so patch 2 has no functional change today.
Patch 3 makes the matching fix to inject_abt64(). Unlike undef
injection, abort injection is reachable from a 16-bit T32 instruction (a
32-bit EL0 task under an AArch64 EL1 guest), so the old code there
injects an abort with IL=0.
Patch 4 fixes the FPAC syndrome constructed during nested ERET
emulation, which did not set IL.
Patches 5-6 fix SError injection in the emulated and nested paths,
neither of which set IL.
Patch 7 fixes a fake ESR used to exit to the host. The host does not
read IL there, so it is not guest-visible.

Changes since v1 [2]:
- Patch 4: keep IL by masking it through from the trapped ERET's ESR
  instead of OR-ing the bit in. The ERET trap (EC=0x1A) always reports
  IL=1, so this preserves the source syndrome rather than adding the
  bit unconditionally (Marc).
- Rebased on v7.1.

Cheers,
/fuad

[1] https://lore.kernel.org/all/87pl1t8q24.wl-maz@kernel.org/
[2] https://lore.kernel.org/all/20260614163336.3490925-1-tabba@google.com/

Signed-off-by: Fuad Tabba <tabba@google.com>