Cleanup various shadow mode asserts.

Cleanup various shadow mode asserts.

Separate out the ability for domains to be able to write to their
pagetables (ala "writable page tables", which uses write-protected PTEs
to address the page tables: this is shadow_mode_write_all()) from the
right of a domain to create a PTE with write permissions that points
at a page table (this is shadow_mode_wr_pt_pte())...

Minor cleanup of SHADOW_DEBUG (at least make it compilable) in shadow.c.