vvmx: fix instruction decode segment limit check

vvmx: fix instruction decode segment limit check

- no limit check for 64-bit mode (and GS: is not special in any way)
- limit check is needed in compatibility mode
- canonical address check should instead be performed for 64-bit mode
- the last accessed byte must be within limits, not the first byte
- past the accessed range
- segment base address should be ignored for 64-bit mode unless FS: or
  GS: is in use

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Acked-by: Tim Deegan <tim@xen.org>
Committed-by: Keir Fraser <keir@xen.org>