Give feature MSRs that same treatment as CPUID and disallow changing said
MSRs after KVM_RUN.
RFC as this is lightly tested and should come with a selftests update to
verify it actually works. Posting early to get feedback on the overall
idea, and on the VMX MSRs trickery (though I think patches 1-2 are a good
idea irrespective of trying to reduce the overhead of the new check).