KVM: SEV: snapshot the GHCB before accessing it