Popping a desc off of a virtio queue should return an error

Today pop_avail is defined like so:

    /// Accummulates a sequence of available descriptors into a `Chain`.
    ///
    /// VirtIO descriptors can be organized into a linked list
    pub fn pop_avail(
        &self,
        chain: &mut Chain,
        mem: &MemCtx,
    ) -> Option<(u16, u32)>

This function likely needs to return Result<Option<(u16, u32), VqError> so we can appropriately handle invalid host/guest state. This means when we detect invalid data from a guest we need to inform the guest that the device needs a reset.

Begin at the Rust pop_avail entry point and trace its callers, especially the handling of Chain, MemCtx, and VqError. Check how invalid guest data is detected and how the device currently communicates reset needs; done means invalid virtio queue state produces the documented error path and informs the guest that reset is required.