arm64: Fix TTBR + PAN + 52-bit PA logic in cpu_do_switch_mm