arm64: Enable kernel branch protection

Add the build flags to enable branch protection on arm64. This enable
the use of PAC and BTI in the kernel.

For PAC we already install the kernel keys when entering the kernel
from userspace so this will start using these to sign the stack.

For BTI we need to mark the kernel page tables with a new guarded page
field. As this will require all code that could be reached through a
function pointer with an appropriate branch target instruction we
are enabling this before setting the field.

As the pointer authentication support shouldn't be reached via a
function pointer it is safe to not enable the use of BTI there.

Reviewed by:	markj
Sponsored by:	Arm Ltd
Differential Revision:	https://reviews.freebsd.org/D42079

sys/conf/kern.mk

@@ -140,6 +140,8 @@ INLINE_LIMIT?=	8000
 CFLAGS += -mgeneral-regs-only
 # Reserve x18 for pcpu data
 CFLAGS += -ffixed-x18
+# Build with BTI+PAC
+CFLAGS += -mbranch-protection=standard
 INLINE_LIMIT?=	8000
 .endif