cstart: do not assume CR4 starts as zero

The BIOS might leave some bits set in CR4; for example, CR4.DE=1 would
cause the SVM test for the DR intercept to fail, because DR4/DR5
can only be written when CR4.DE is clear, and otherwise trigger
a #GP exception.

Reported-by: Nadav Amit <namit@vmware.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>