Allow specifying notify or ppcalls on a per-channel, not per-protection domain basis

[midnightveil]

Also fixes #168, as this allows us enough precision to check priorities.

Can specify pp="true" or notify="false" (or vice-versa, for the defaults):

<?xml version="1.0" encoding="UTF-8"?>
<system>
    <protection_domain name="test1">
        <program_image path="test" />
    </protection_domain>
    <protection_domain name="test2">
        <program_image path="test" />
    </protection_domain>

    <channel>
        <end pd="test1" id="0" pp="true" notify="false" />
        <end pd="test2" id="5" />
    </channel>
</system>

ToDo:

• [x] Parsing tests
• [x] Behaviour tests (it works on at least one system, but...)
• [x] Probably documentation of changes (where?)
• [x] Enforcing ppcall priority invariant
• [x] Syntax bikeshedding

[Ivan-Velickovic]

The first two commits look good, I'll review the main commit once the PR is ready for review.