class RootResourceFilter

The RootResourceFilter tracks the regions of the various resource address

spaces we may never grant access to, even if the user has access to the root

resource. Currently this only affects the MMIO space. Any attempt to register

a deny range for some other resource will succeed, but no enforcement will

happen. The current set of denied MMIO ranges should consist of:

1) All physical RAM. RAM is under the control of the PMM. If a user wants

access to RAM, they need to obtain it via VMO allocations, not by

requesting a specific region of the physical bus using

zx_vmo_create_physical.

2) Any other regions the platform code considers to be off limits. This

usually means things like the interrupt controller registers, the IOMMU

registers, and so on.

Note that we don't bother assigning a RegionPool to our region allocator,

instead we permit it to allocate directly from the heap. The set of

regions that we need to deny is 100% known to us, but it is never going to

be a large number of regions, and once established it will never change.

There is no good reason to partition the bookkeeping allocations into their

own separate slab allocated pool.