soc/intel/apl: program VMX per Kconfig setting

While FSP programs the VmxEnable UPD per CONFIG_ENABLE_VMX, it doesn't
set the lock bit, which prevents Windows from enabling virtualization
on devices which support it. Call set_vmx_and_lock() to ensure the
lock bit is properly set.

TEST=build/boot Win11 on google/ampton,reef; verify virtualization
enabled.

Change-Id: I54ea0adb0a6d10f2df18f604b1f1e5a7a145dfb3
Signed-off-by: Matt DeVillier <matt.devillier@gmail.com>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/76804
Reviewed-by: CoolStar <coolstarorganization@gmail.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Sean Rhodes <sean@starlabs.systems>

src/soc/intel/apollolake/cpu.c

@@ -80,6 +80,9 @@ void soc_core_init(struct device *cpu)
 
 	set_aesni_lock();
 
+	/* Set virtualization based on Kconfig option */
+	set_vmx_and_lock();
+
 	/*
 	 * Enable ACPI PM timer emulation, which also lets microcode know
 	 * location of ACPI_BASE_ADDRESS. This also enables other features