x86/vvmx: virtualize x2APIC mode and APIC accesses can't both be enabled

x86/vvmx: virtualize x2APIC mode and APIC accesses can't both be enabled

According to the Intel SDM, "virtualize x2APIC mode" and "virtualize
APIC accesses" can't be enabled at the same time, or else a
vm{launch/entry} failure will happen. This was seen when running Xen
nested and with x2APIC enabled:

  (XEN) d3v0 VMLAUNCH error: 0x7
  [...]
  (XEN) *** Control State ***
  (XEN) PinBased=0000003f CPUBased=b6a075fe SecondaryExec=000014fb
  [...]

Fix this by making sure nvmx_update_secondary_exec_control clears the
incompatible bits from the host vmcs before merging it with the nested
vmcs.

This fixes a regression reported by osstest in the
test-amd64-amd64-qemuu-nested-intel job.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>