Split ServerImpl versus FlashDriver, add FailServer

[mkeeter]

Staged on top of #1851

This PR splits the FMC NOR flash into FlashDriver (talking to the FPGA and flash) and ServerImpl (implementing the HostFlash API). In addition, it adds a non-panicking failure path. In this new failure path, there's a small Idol server which replies with an error to any message.

[hawkw]

This seems good to me! I had a couple smallish notes, but nothing major.

[hawkw]

This is a nice approach to having a driver go into "failure mode" when hardware can't be initialized, I wonder if we might want to do something similar in e.g. gimlet_seq, here:

hubris/drv/gimlet-seq-server/src/main.rs

Lines 159 to 176 in 6990578

	// Initializing the sequencer failed.
	Err(_) => {
	// Tell everyone that something's broken, as loudly as possible.
	ringbuf_entry!(Trace::StartFailed(SeqError::I2cFault));
	// Leave FAULT_PIN_L low (which is done at the start of init)
	// All these moments will be lost in time, like tears in rain...
	// Time to die.
	loop {
	// Sleeping with all bits in the notification mask clear means
	// we should never be notified --- and if one never wakes up,
	// the difference between sleeping and dying seems kind of
	// irrelevant. But, `rustc` doesn't realize that this should
	// never return, we'll stick it in a `loop` anyway so the main
	// function can return `!`
	sys_recv_notification(0);
	}
	}

rather than just waiting for a non-existent notification?

Obviously not something to do in this PR, but could be nice to do later.