feat: support large(or explicitly-sized) sandbox for x64

[t-noh]

Currently, changes are fairly FF-specific.

1. Enabling large sandbox must disable ctxreg as it uses r15 as mask.
2. FF uses GS as TLS base, so it introduces two uses of GS; segue(sandbox base) or TLS.
3. FF runs single sandbox, so it sets GS once at spawn.

• We should fix the naming of "large-sandbox" scheme, unless a decision has already been made.