Merge verified chunk into frame allocator

[Ramla-I]

This PR merges a verified TrustedChunk type into the frame allocator code. The main changes are:

trusted_chunk crate:

• submodule that contains the TrustedChunk type, a linked list and static array for bookkeeping, and their verified functions.

frame_allocator crate:

• The frame allocator no longer uses Chunk for bookkeeping. It used a linear Frames type in the free lists which represents ownership of a range of frames, and a separate type Region for bookkeeping.
• Since Frames can't be cloned, the frame allocator logic to find and merge frames is slightly changed. A Frames object has to be removed from the free list before it can be merged or split.
• Frames owns an instance of a verified TrustedChunk, and its functions are wrappers over the TrustedChunk new, merge, split and split_at methods.
• I use my own version of RangeInclusive within the frame allocator that implements an iterator that doesn't mutate the range.
• AllocatedFrames is merged into the Frames type. There are two states for a Frames object: Unmapped and Mapped. Mapped is only used briefly once a MappedPages is created.
• AllocatedFrame type is renamed to UnmappedFrame

frame_range_callbacks crate:

• the callbacks that crate a TrustedChunk and AllocatedFrames from an UnmappedFrames are in this crate. This is to minimize the amount of code that has access to these callbacks.

memory crate:

• use the callbacks in the frame_range_callbacks crate rather than storing them in the memory crate

memory_structs:

• use our own range inclusive and the provided iterator
• add a to_range_inclusive function for PageRange and FrameRange