KVM: MMU: Add for_each_shadow_entry(), a simpler alternative to walk_shadow()