riscv: PLIC tenant mode (own contexts, granted sources only)

[congwang-mk]

Part of the RISC-V port. Needed for PLIC platforms (SiFive, StarFive, SG2042, T-Head, QEMU virt without AIA).

PLIC layout: per-source priority (global), per-context (hart x privilege) enable bits, threshold and claim/complete. Partition by source; the spawn uses only its own harts' S-mode contexts.

• Tenant mode in drivers/irqchip/irq-sifive-plic.c, selected by a DT property on the PLIC node plus granted source ranges (linux,multikernel-sources = <start count>...):
  • plic_probe() writes priority 1 to every source and masks every source in every context it owns. Restrict both loops to granted sources (the host already set the same priority, but writing another instance's sources is the wrong principle and breaks if the host ever uses priorities).
  • Contexts: only those whose hart is in this kernel; the existing per-context handler setup already skips contexts for CPUs it does not know.
  • plic_irqdomain_ops.translate/alloc: reject sources outside the granted ranges with -EPERM.
  • plic_set_affinity(): target must be one of this kernel's contexts.
  • Keep the syscore save/restore and enable_save paths correct for the restricted set.
• Host side: manifest carries the source ranges; the host masks handed-out sources in its own contexts and retakes them on teardown.
• Vendor MSI-to-wired bridges (SG2042) are wired sources and partition the same way.

Test on QEMU virt (default PLIC): host keeps its UART/virtio sources live while a spawn owns a disjoint range.