target/arm: Fix CNTPOFF_EL2 trap to missing EL3