Popping a desc off of a virtio queue should return an error

[papertigers]

Today pop_avail is defined like so:

    /// Accummulates a sequence of available descriptors into a `Chain`.
    ///
    /// VirtIO descriptors can be organized into a linked list
    pub fn pop_avail(
        &self,
        chain: &mut Chain,
        mem: &MemCtx,
    ) -> Option<(u16, u32)>

This function likely needs to return Result<Option<(u16, u32), VqError> so we can appropriately handle invalid host/guest state. This means when we detect invalid data from a guest we need to inform the guest that the device needs a reset.