fix(RVH): check HLVX final physical execute permission

[fuhuakai]

The RISC-V HLVX instructions are loads for exception reporting, but their target address must also satisfy execute permission checks at the final physical level. NEMU already modeled this during page-table permission checks by using the global HLVX state when checking PTE permissions.

The original code has a bug in the final physical PMP and PMA checks. The translated HLVX access reached paddr_read as a normal read, so PMP and PMA checked only read permission. A region with R=1 and X=0 could be read by HLVX, which made the directed HLVX PMA test miss the expected load access fault.

Fix this by adding a MEM_TYPE_READ_EXEC access type for the final physical read. HLVX requires two distinct values for permission checking vs. trap classification: the PTW and page-fault logic must see MEM_TYPE_READ (since isa_mmu_translate uses type to select fault class and index internal arrays), while the final PMP/PMA check must see MEM_TYPE_READ_EXEC (requiring both R and X). The intermediate- layer functions (hosttlb_read, vaddr_mmu_read, vaddr_read_cross_page) therefore carry both values, named "type" for the permission-check type and "trap_type" for the fault-classification type, matching the convention already used by paddr_read.

This has been verified using the workload provided at OpenXiangShan/XiangShan#5995. After the XiangShan cores and NEMU jointly fixed this bug, enabling the difftest can successfully pass the test.