KVM: arm64: selftests: Cover the protected VM userspace API rejections

KVM refuses host access to a protected VM's register and power state
once a vCPU has run, and rejects a vCPU configuration EL2 will not
honour: an unavailable feature, or a PSCI version below the one it
serves. Nothing tests it.

Extend the pKVM selftest with a rejection matrix: stage boot state before
the first KVM_RUN, then check the errno of each refused ioctl after it. A
secondary vCPU the guest never onlines supplies the powered-off state,
where KVM_SET_MP_STATE(RUNNABLE) and (SUSPENDED) must fail while STOPPED,
the VMM's pause path, must still succeed.

Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>