Enforce physical-address canonicalization

When xLen > paddrBits, enforce that physical addresses are zero-extended.
This works by checking that the _virtual_ address is _sign_-extended, then
checking that its sign is positive.