Previously, `file_open()` and `file_close()` on a Protected File had
weird semnatics: if the same PF was opened twice, there was only one PF
context created, but there were several underlying host FDs. Even
weirder, the PF context tied itself to the host FD (the very first
opened one) using the pointer to this FD: `&pal_handle->file.fd`.
This resulted in bugs and cumbersome workarounds: the associated PAL
handle could be closed and freed by our common PAL code, and the PF
context would contain a dangling pointer. And for `file_attrquery()`,
there was a workaround to destroy the PAL context if it seemed to be
created only for this attrquery flow.

This commit fixes these bugs: the PF context stores the underlying host
FD directly, and doesn't open new FDs on subsequent `file_open()`. So,
there is always only one host FD for one PF context. As a side effect,
the logic of `file_open()` and `file_close()` is refactored.

A new LibOS regression test `protected_file` is added for GDB debugging
because the dedicated `fs/` tests are harder to debug.

Signed-off-by: Dmitrii Kuvaiskii <[email protected]>

Signed-off-by: Dmitrii Kuvaiskii <[email protected]>

Signed-off-by: Dmitrii Kuvaiskii <[email protected]>