arm64: Use the right PTE when downgrading perms in pmap_promote_l2()

When promoting a run of small mappings to a superpage, we have to
downgrade clean, writable mappings to read-only, to handle the
possibility that the MMU will concurrently mark one of the mappings as
dirty.

The code which performed this operation for the first PTE in the run
used the wrong PTE pointer. As a result, the comparison would always
fail, aborting the promotion. This only occurs when promoting writable,
clean mappings.

Fixes: ca2cae0b4dd
Reviewed by: alc, kib
Sponsored by: The FreeBSD Foundation

(cherry picked from commit a48f51b3d396664f9b0a91f016159f4e4324da85)