Add parameter attributes for {deep,shallow} {immutable, no-capture} permissions.

[davidchisnall]

The CHERIoT ISA has permissions that are intended to be useful to remove on call boundaries:

• Store (make something shallow read-only)
• LoadMutable (make something deep read-only)
• Global (shallow no capture)
• LoadGlobal (deep no capture)

We should add parameter attributes that allow these to be removed declaratively, especially on cross-compartment calls that don't. They should also add the relevant LLVM IR attributes to allow optimisation in the caller based on the properties that we're enforcing in hardware.