target/arm: Separate out Neon from VFP access checks

Currently we use vfp_access_check() for AArch32 VFP and Neon
instructions.  This is not quite right:
 * there are optional CPACR.ASEDIS and HCPTR.TASE controls that allow
   trapping of just the Neon and not VFP instructions
 * Neon instructions are supposed to report a slightly different
   syndrome in HCR when they trap to AArch32 EL2

As a preliminary refactor so we have somewhere we can make this
distinction, separate out Neon access checks into a separate
neon_access_check(), which initially just calls vfp_access_check().

The set of insns this needs to cover are those described in section
E1.3.9 of the DDI0487M.b Arm ARM.  For us this corresponds to
everything in neon-dp.decode and neon-ls.decode and thus in
translate-neon.c, plus three insns that we handle in translate-vfp.c:
 - VDUP (general-purpose register)
 - VMOV (general-purpose register to scalar) byte and halfword
 - VMOV (scalar to general-purpose register) byte and halfword
(which are the ones in that file with ARM_FEATURE_NEON checks).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20260702184019.3431139-2-peter.maydell@linaro.org