arm64: Support counter access with E2H

When entering the kernel with the E2H field set the layout of the
cnthctl_el2 register changes. Use the correct field locations to enable
access to the counter and timer registers from EL1.

Sponsored by: Arm Ltd
Differential Revision: https://reviews.freebsd.org/D45529