KVM: MMU: Use for_each_shadow_entry() in __direct_map()