Add NVMe BP write-protection (BPWPS) emulation to QEMU hw/nvme (part 2)

[kat-perez]

Test-environment prerequisite (part 2 of 2): adds the write-protection (BPWPS) half of NVMe Boot Partition emulation to the local QEMU fork. Builds on #74 (read + firmware-update half). Upstreaming both is deferred to a later issue.

Scope (Iter 6):

1. Add Set Features FID 0x11 (Boot Partition Write Protection / BPWPS) with all four states from NVMe Base Spec §5.27.1.17:
   • 000b — No Write Protect
   • 001b — Write Protect (until power cycle)
   • 010b — Write Protect (persistent)
   • 011b — Permanent Write Protect
2. Reject Firmware Commit (0x10) targeting the BP when the active partition's BPWPS state is anything other than 000b. Surface as Boot Partition Write Protected status.
3. State transitions:
   • 000b ↔ 001b ↔ 010b allowed.
   • 011b is one-way (no transitions out).
   • 001b clears to 000b on controller reset / power cycle equivalent (track via nvme_ctrl_reset()).
4. Add VMState entries for bpinfo, bpwps, and the BP buffer contents so live migration is coherent across both halves.
5. Add formal qtest coverage in tests/qtest/nvme-test.c exercising the full flow from Add NVMe BP read + firmware-update emulation to QEMU hw/nvme (part 1) #74 + this issue:
   • Firmware Download → Commit(0x6 replace) → Commit(0x7 activate)
   • BPRSEL / BPMBL read path
   • Set Features BPWPS=001b → Firmware Commit rejected
   • Reset → BPWPS=000b again, Firmware Commit accepted
   • Set Features BPWPS=010b → Commit rejected, persists across reset
6. Document the new bootpart= device property in docs/system/devices/nvme.rst, including the BPWPS state machine.

Depends on: #74.
Unblocks #49, #53 (boot-partition write-lock for normal boot and post-capsule lock).

Out of scope:

• Upstreaming the combined Add NVMe BP read + firmware-update emulation to QEMU hw/nvme (part 1) #74 + this issue series — separate follow-up.