feat: allow vats to be marked critical and panic the kernel if a critical vat fails

[FUDCo]

Vats now accept a critical property as one of their creation options. If a vat is marked as critical, failure of that vat causes a kernel panic.

In order to avoid allowing just anyone to set up a situation that could bring down the kernel and thus the chain, dynamic vats cannot be configured as critical simply by setting the critical option to true (as they can with static vats). Instead, for the critical option value you must provide the "critical vat key", a capability that can only be obtained from the vatAdmin vat. The vatAdmin root now supports an additional method, getCriticalVatKey() which returns this capability. Note that this is only available on the vatAdmin root object, not on any vatAdminService object, and thus is initially only available to the bootstrap vat.

Fixes #4279

[warner]

Looks great! Thanks for catching that exitVatWithFailure-doesn't-unwind bug.

A few nits, and we need to figure out the CI thing (but it's probably transient, maybe a timeout or the CI host got rebooted or something?).