statx: -EPERM from the readable-path policy is overwritten by the host statx() call

[perbu]

lib/tinykvm/linux/system_calls.cpp:3057 (SYS_statx).

The is_readable_path() check sets regs.sysret() = -EPERM inside a bare if
with no else and no early return, so the fd translation and the host
statx() call below it run unconditionally and overwrite sysret(). The
sibling newfstatat handler at :2528 gates the same check correctly, so the
two handlers disagree on the same denied path.

Fix: move the fd translation and the host call into the else of the
is_readable_path check, preserving the existing path.empty() /
AT_EMPTY_PATH case.

Found by an internal audit of the host-side Linux emulation. A fix PR with a
regression test follows.

[perbu]

Fix in #108.