Calling memory_region_destroy() in a transaction is illegal (and aborts),
as until the transaction is committed, the region remains live.

Fix by moving destruction until after the transaction commits.  This requires
having an extra set of regions, so the new and old regions can coexist.

Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>