* Give arch_vm_supports_protection a team_id argument (primarily
to allow the kernel address space to be more restricted than
user ones.)
* Move invocation of arch_vm_supports_protection to a static method,
and also call fix_protection from there.
* Consolidate protection checks.