Implement mprotect for wasmtime

Currently, we don't actually make the wasmtime guard regions into proper guard regions: reads/writes to/from them won't actually fault. This can probably be used to escape from wasmtime (but not to escape from the guest, which is the real security boundary), so we  should fix this as soon as possible.