Allow CAndPerms to clear global on sealed caps?

[rmn30]

@arichardson pointed out that it's a little odd that CAndPerms can't clear the global (GL) perm on sealed capabilities: it's possible to clear it by storing to memory and loading via a capability without load_global (LG) anyway. It might be useful to be able to delegate a sealed capability only for the duration of a compartment call, so it might be convenient to allow this. The question is what exactly should the semantics be and how much does it cost hw?

I can think of two ways we could allow this:

1. allow the mask that is all ones except for GL to be used on sealed capabilities. Other masks will clear the tag if used on sealed capabilities.
2. compare the original permissions to the masked permissions using xor and clear the tag if there are any bits set except for GL.

The second is more general in that it allows applying any mask that would have no effect on the permissions except for the global bit. However, it is probably a little more expensive to implement in hardware. Thoughts @kliuMsft ?

[nwf]

(Just adding xrefs to #14 and #44)

[davidchisnall]

It would be nice to do this in v1. It's inconsistent that you can clear a permission using a store and load, but you can't as a register-register operation.

[rmn30]

Resolved via #83