[pmp/debug]: Debug Mode data access uses `mstatus.MPRV` when `dcsr.mprven=0`

@SamuelRiedel is already working on this.

Since Sep 3, 2026.

## Observed Behavior

Ibex hardwires `dcsr.mprven` to zero. However, a data access executed in Debug Mode still uses `mstatus.MPRV` and `mstatus.MPP` to select the PMP privilege level.

The test enters Debug Mode with:

```text
mstatus.MPRV = 1
mstatus.MPP = U
dcsr.mprven = 0
```

The Debug ROM then executes a load from `0x3000`. The current RTL reports:

```text
priv_lsu = U
pmp_err = 1
external_req = 0
```

The access is checked as a U-mode access and is rejected by PMP.

## Expected Behavior

According to Sections 4.1 and 4.8 of the [RISC-V External Debug Support Specification 0.13.2](https://content.riscv.org/wp-content/uploads/2019/03/riscv-debug-release.pdf), Debug Mode must ignore `mstatus.MPRV` when `dcsr.mprven=0`.

The same load should therefore use M-mode privilege. The expected result is:

```text
priv_lsu = M
pmp_err = 0
external_req = 1
```

## Steps to Reproduce

1. Build and run the test with Verilator: `run_ibex_core_debug_mprven.sh`
2. The test configures an RX PMP region for the program and Debug ROM, and an X-only region covering `0x3000`–`0x3fff`.
3. The M-mode program sets `mstatus.MPRV=1` and `mstatus.MPP=U`.
4. The test enters Debug Mode through `debug_req_i`.
5. The Debug ROM executes `lw t2, 0(t1)` with `t1=0x3000`.
6. Observe the effective LSU privilege, the PMP error, and the external data request.

The current RTL produces:

```text
debug target load: priv_lsu=0 pmp_err=1 external_req=0 mprv=1 mpp=0
```

The test intentionally fails when the observed result does not match the expected M-mode access.

## Testbench

```text
ibex_core_debug_mprven_tb.sv
```

[testcases.zip](https://github.com/user-attachments/files/31058201/testcases.zip)

## Environment

Ibex source revision: `57d37bf9008640415532d23ad59018b795c642aa`.

The test uses Verilator and the real `ibex_core`.