RTOS is running with uVisor privileges

When we integrated uVisor and an RTOS in the 'dev' branch, we did not yet de-privilege the RTOS. All RTOS-specific code, like mutexes, the scheduler, timers, and so forth currently run with uVisor privileges. Some uVisor-to-RTOS glue code in uvisor-lib also runs with uVisor privileges. This is not final and we must fix it.

Ideally, no code would run privileged outside the reproducibly built uVisor binary. This enables us to make security promises because all privileged code would run inside a the reproducible uVisor binary.

Furthermore, removing uVisor privileges from the RTOS will reduce the attack surface of systems built with uVisor.

Review the RTOS integration in the dev branch, including the RTOS-specific code and uVisor-to-RTOS glue in uvisor-lib. First map which scheduler, mutex, timer, and glue paths execute with uVisor privileges. Done means privileged execution is confined to the reproducibly built uVisor binary and the integration still operates correctly.

Written by the indexing model from the issue text.