x86: Add RO/NX protection for loadable kernel modules