v7M MPU is enabled too early

During the initialisation of the vmpu in the procedure `vmpu_init_post`:

1. The MPU is enabled by `vmpu_arch_init()` which calls `vmpu_mpu_lock()`
2. Box configurations are loaded and regions are programmed for box 0 by `vmpu_load_box()`

This means that the MPU is enabled at (1) and *subsequently* has regions programmed at (2). At (1), only static regions will have been programmed. In particular, higher-numbered regions will still have their reset value (UNKNOWN); hence, this is architecturally UNPREDICTABLE.

A fix is to move the call to `vmpu_mpu_lock()` after `vmpu_load_box()`. This guarantees that all RBAR/RASR registers have been written-to (by `vmpu_mpu_invalidate()`) before the MPU is enabled.

Found using ArchEx.

Start in the vmpu_init_post procedure and trace vmpu_arch_init(), vmpu_mpu_lock(), and vmpu_load_box(). Confirm the initialization order and use ArchEx to check that all RBAR/RASR registers are written before the MPU is enabled. Done means the MPU is locked only after vmpu_load_box() completes and the architecture check no longer reports this unpredictability.

Written by the indexing model from the issue text.