mm: support promotion-only NUMA hinting scans

新增 MM_CP_PROT_NUMA_PROMO_ONLY，让 change_prot_numa() 发起仅 promotion 的 NUMA hinting walk，并在 PTE/PMD 路径统一传递该标志。