Replace the special ibl xfer with a non-app exit cti mechanism

Instead of DR providing the address of a trampoline (which puts the app
target in the right IBL reg and jumps to the appropriate IBL) and a client
or drwrap inserting a meta indirect branch to that trampoline out of the
middle of a fragment, which DR then has trouble unlinking for signals
(#4670), this is a proposal to instead have DR provide a mechanism for a
client to create a fragment exit which is not considered an app
instruction. It would be a special meta indirect branch that DR would
mangle and emit as an exit cti, just like an app indirect branch. Then
regular unlinking and linking would work.