[snitch] NaN-box narrow FP loads (flw) in the LSU return path

[emiliengnr]

Hello, here is a pull request for a bug I found.

flw does not NaN-box the loaded single-precision value. The FP LSU ties
fp_lsu_qsigned to 0, and the load return path gated NaN-boxing on
sign-extension ((data[msb] | NaNBox) & sign_ext), so the boxing was dropped
and flw zero-extended into the 64-bit FP register. When a later
double-precision instruction reads that register it sees an ordinary number
where the spec requires a NaN, and its result diverges from the reference.

The fix makes NaN-boxing unconditional in the load return path
((data[msb] & sign_ext) | NaNBox). It is bit-identical for the integer LSU
(NaNBox=0) and forces the upper bits to all-ones for the FP LSU.