_sceKernelAllocateTlspl: Check user pointers, support the timeout

The third argument is a timeout pointer, as threadman.prx shows. A kernel
address from user mode is ILLEGAL_ADDR there; we used to write through it.
Also, no lookup by index: the syscall requires the exact uid.

Adds the threads/tls/allocate test, recorded on hardware.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

test.py

@@ -392,6 +392,7 @@ tests_good = [
   "threads/threads/threadmanidlist",
   "threads/threads/threadmanidtype",
   "threads/threads/threads",
+  "threads/tls/allocate",
   "threads/tls/create",
   "threads/tls/partition",
   "threads/tls/kernel/partition",