A MAP_SHARED, PROT_READ mapping of a file opened O_RDONLY could never be
installed. hvf_apply_file_overlay_quiesced() always mmap'd the host page
PROT_READ|PROT_WRITE and mapped the HVF segment RWX. On a read-only fd the
host mmap fails with EACCES (writable mapping of an O_RDONLY fd); forcing
PROT_READ then trips hv_vm_map(), because a MAP_SHARED mapping of an
O_RDONLY fd has macOS max_protection=READ and HVF cannot grant stage-2
rights (RWX) beyond the host region's max_protection (HV_ERROR).

This blocked every workload that maps a read-only file MAP_SHARED -- most
visibly the JVM, which maps its ~135 MiB lib/modules image exactly this
way and crashed on startup.

Choose the host backing from what the fd and the guest actually need:

• guest wants PROT_WRITE: MAP_SHARED PROT_READ|PROT_WRITE (writes reach
  the file; an O_RDONLY fd still yields EACCES, matching Linux).
• guest read-only on a writable fd: MAP_SHARED PROT_READ (max_protection
  is RWX, so the segment maps and cross-mapping coherence is preserved).
• guest read-only on an O_RDONLY fd: MAP_PRIVATE PROT_READ. Its
  max_protection is RWX so the segment maps; the pages still show file
  content, and the guest's stage-1 tables keep the region read-only so
  the private copy is never dirtied -- no observable MAP_SHARED
  divergence for a read-only mapping.

The guest-requested prot is threaded through hvf_apply_file_overlay(),
hvf_apply_file_overlay_quiesced(), and restore_file_overlay_range() so
every overlay install/restore site picks the correct backing.

Add test-mmap-shared-ro covering the O_RDONLY read path, a second
concurrent read-only mapping, EACCES on a writable request, and the
read-only-mapping-on-O_RDWR-fd branch.

(cherry picked from commit 337d39a4313109884112a86a0c4147bddfe18fa1)

Summary by cubic

Fixes read-only MAP_SHARED mappings of O_RDONLY files by using MAP_PRIVATE when needed, returns EACCES for MAP_SHARED|PROT_WRITE on read-only fds, and blocks mprotect(PROT_WRITE) upgrades to preserve Linux max_prot semantics. This unblocks JVM lib/modules and matches Linux behavior.

• Bug Fixes

  • Select backing by requested prot and fd mode:
    • Read-only on O_RDONLY: MAP_PRIVATE | PROT_READ.
    • Read-only on writable fd: MAP_SHARED | PROT_READ.
    • Writable: MAP_SHARED | PROT_READ|PROT_WRITE (EACCES on O_RDONLY).
  • In sys_mmap (non-fixed), reject MAP_SHARED | PROT_WRITE on read-only fds early with EACCES (no silent snapshot).
  • Track read-only shared backing with backing_ro and reject mprotect(PROT_WRITE) with EACCES; keep this across snapshots and all sys_mremap paths; prevent region merges when backing_ro differs.

• Tests

  • Add test-mmap-shared-ro covering: read-only MAP_SHARED on O_RDONLY, concurrent read-only mappings, EACCES on writable request, read-only mapping on an O_RDWR fd, and EACCES on mprotect(PROT_WRITE).

^{Written for commit bdde276. Summary will update on new commits.}