Add support for split program images

[nspin]

There are cases where it would be useful to be able specify the program image separately from the symbols that will be used to manipulate it.

seL4/rust-sel4#167 adds support for resettable protection domains. The best way that I've come up with to achieve this requires manipulating the program image after linking. Specifically, a new program image is created from the original, and the result is an ELF file with only program headers, and no section headers. The symbol and debugging information in the original ELF file still apply to the final program image. So, we are left with one ELF file specifying the program image, and one ELF file with symbol and debugging information.

This PR adds support for the optional path_for_symbols attribute on the <program_image> element, which allows for such a split program image.

[nspin]

I've updated the PR. I've also moved code around to minimize the diff to make it easier to review. If it is going to be accepted, I'll reorganize the code again in an additional to make it more natural to read linearly.