vmm(4): flush EPTs after enabling VMX mode.

vmm(4): flush EPTs after enabling VMX mode.

The Intel SDM states the vmxon/vmxoff instructions don't invalidate
any EPT states on the cpu and recommend invalidating the global
context. vmm(4) opportunistically disables and enables VMX mode as
vms are created or terminated, so this adds a recommended
housekeeping step per the SDM.

While here, tidy up the CR4 toggling by moving it to after the MSR
feature check.

ok mlarkin@