Add guard pages around workspaces

[mmcgee-jump]

See #968 . The workspaces are mapped to a random address, but it's possible (about 1/400,000) that gigantic pages would end up adjacent, and so an overrun could step into another workspace. This can be prevented by adding guard pages around each workspace.