xen/arm: Support properly __ro_after_init on Arm

xen/arm: Support properly __ro_after_init on Arm

__ro_after_init was introduced recently to prevent modifying
some variables after init.

At the moment, on Arm, the variables will still be accessible
because the region permission is not updated.

Address that by moving the sections .data.ro_after_init
out of .data and then map the region read-only once we finish
to boot.

Signed-off-by: Julien Grall <jgrall@amazon.com>
Reviewed-by: Penny Zheng <penny.zheng@arm.com>
Reviewed-by: Bertrand Marquis <bertrand.marquis@arm.com>
Tested-by: Henry Wang <Henry.Wang@arm.com>