dynamic feature: capability delegation

[ZGwtao]

This PR adds initial support for capability delegation between a parent protection domain (delegatee) and its direct child protection domains (delegators). It introduces the delegatee PD attribute and the delegated attribute for channel ends, memory-region mappings, and x86 I/O ports, with delegated capabilities placed in a per-pair delegation CNode rather than being initially available in the delegator's CSpace.

The microkit tool creates and exposes the delegation CNode to the delegatee (parent), supports runtime installation of delegated capabilities, and keeps delegated memory-region frames unmapped at the leaf level so that the delegatee can establish mappings dynamically. IRQ delegation is intentionally not supported. The PR also adds validation for the new SDF semantics, documentation of the delegation model and CSpace layout, and a cap_delegate example demonstrating both delegated channel capabilities and demand mapping of a delegated memory region.

Conceptually, the CSpace layout for each delegator-delegatee pair looks like:

Delegatee PD                         Delegator PD
(parent)                             (child)

    root CNode                     ----> root CNode (A)
        |                          |       |
        |                          |       |
        +-- Microkit CNode         |        +-- Microkit CNode (B)
          |                        |            ^
     -> +-- delegation CNode (C)   |            |
     |          |                  |            |
     |          +-- cap -> A -------            |
     |          +-- cap -> B --------------------
     cap <-C -- +
                |
                +-- delegated resource caps

(for more information, see commit files)

[ZGwtao]

P.S., for now all child PDs of a delegatee PD are seen as delegators, which implies an implicit restriction on the number of available child PDs of PDs with delegatee="true", as the number of slots in the root CNode of delegatee for storing the cap of delegation CNode (of each delegator-delegatee pair) is limited (48~63).

I promise I will fix this design issue later.

[ZGwtao]

P.S., for now all child PDs of a delegatee PD are seen as delegators, which implies an implicit restriction on the number of available child PDs of PDs with delegatee="true", as the number of slots in the root CNode of delegatee for storing the cap of delegation CNode (of each delegator-delegatee pair) is limited (48~63).

I promise I will fix this design issue later.

This issue is fixed by the latest commit, which allows a delegatee PD to have more than 16 child PDs, while maximally 16 delegator child PDs.