Mutable references to the HV doorbell page are never given, as its
data is fully atomic. Thus, there is no need to use raw pointers.

Since we need a pointer to the location of the safe reference itself
in the PerCpu for #HV servicing, use a OnceCell, which gives out
references to the inner T under the assumption that the type can only
be set once, which suits our use. With a &T (in this case a &&'static
HVDoorbell), we can obtain a pointer to the inner value.

Signed-off-by: Carlos López <[email protected]>

Document some parts of the PerCpu that might not be straightforward to
understand.

Signed-off-by: Carlos López <[email protected]>

There is no need for the several steps of SVSM VMSA initialization to
be split up, and they only make for a more awkward initialization.
Thus, merge them into a single PerCpu method.

Signed-off-by: Carlos López <[email protected]>

start_cpu() had several calls to expect() on various error conditions.
Clean up the function by returning the error and letting the caller
panic with the specific error.

Signed-off-by: Carlos López <[email protected]>

The SVSM VMSA only needs to me mutated during initialization. Thus
simply encapsulate that step in a PerCpu method and store an
immutable reference to the VMSA, avoiding the possibility of mutably
aliasing it.

This obsoletes the VmsaRef type.

Signed-off-by: Carlos López <[email protected]>