Populate tval with pc when ebreak

Ref to https://github.com/riscv/riscv-isa-manual/commit/51522f98b5cae989c7d161e00b20a08483a2301e
and https://github.com/riscv-software-src/riscv-isa-sim/commit/be5af59bcaca4dc90a0d276e1eccc4f4896b0373

There are two code paths for the spec "When a breakpoint ..,
occurs, mtval is written with the faulting virtual address".
One is hardware braekpoint, which is covered by
wb_reg_cause.isOneOf(Causes.breakpoint;
the other is software breakpoint, which is only
handled in CSRFile since ebreak is only decoded there,
and the main pipeline (RocketCore.scala) does not raise exception,
(tval_valid is false.B because wb_expt is false.B)

So to properly set tval, Another level of Mux
is needed.