target/riscv: Fix CSR perm checking for HS mode