fix(x86_64/qemu): use q35 PCI windows

[tiniham]

platform.mk already tells QEMU to use -machine q35, but board.rs's
PCI config didn't get the memo — ecam_base was set to 0xe0000000, which
isn't where q35 actually puts its ECAM region. QEMU/SeaBIOS/OVMF program
q35's PCIEXBAR at 0xb0000000 by default, and that's also what shows up in
the ACPI MCFG table, so any guest that reads MCFG instead of trusting a
hardcoded value would compute extended-config-space addresses that land
0x30000000 away from where hvisor's own root-zone config expects them.

Separately, there was no passthrough memory region for q35's PCIe 32-bit
MMIO BAR window (0xfe000000, size 0xc00000) — right below the existing
HPET/IOAPIC entries at the top of the address space. Without an entry
there, any device whose BAR firmware places in that window (which, again,
is exactly where q35 puts them) has nothing backing it in the guest's
stage-2 tables.

Fixed both: ecam_base corrected to 0xb0000000, and an 11th region added
to ROOT_ZONE_MEMORY_REGIONS covering the MMIO window.

This isn't Asterinas-specific — it's a bug in the existing qemu board's own
PCI config, equally wrong for the current Linux root zone. Verified:
make ARCH=x86_64 BOARD=qemu MODE=release all,
cargo fmt --all -- --check, both clean.