Fix a bug in pmap_tlb_shootdown_all_user(), where it was not
stashing away the pointer to the pmap in the TLB context structure
like pmap_tlb_shootdown() was doing.  This would result in the
following failure scenario:

- Page fault handler calls pmap_enter() to map a page.  Mapping
  is the first one for that L2 PT L3 PT, meaning that an L2 PT
  and an L3 PT must be allocated.
- L2 PT allocation succeeds.
- L3 PT allocation fails under memory pressure.
- pmap_enter() goes to drop the reference on the L2 PT, which, because
  it was the first of its mappings, frees the L2 PT.  Becuse PALcode
  may have already tried to service a TLB miss though that L2 PT, we
  must issue an all-user-VA shootdown, and call pmap_tlb_shootdown_all_user()
  to do so.
- pmap_tlb_shootnow() is called and an assert fires because the TLB
  context structure does not point to a pmap.

This did not fail in the pmap_remove() scenario because the TLB context
would have already had at least one call to pmap_tlb_shootdown(), which
was initializing the pmap pointer properly.

PR port-alpha/56200

(thorpej)