libqos: Use explicit QTestState for fw_cfg operations