Declare the readpmc value parameter by reference

native.inc declared readpmc(pmc, value) while natives_impl.h implements
cell readpmc(cell pmc, cell& value). The arity matches, so the arity check
could not catch it: the kernel took the integer supplied by the module and
used it as an AMX address, either aborting the whole IOCTL or -- if the
integer happened to be a valid in-bounds address -- writing the counter into
an unrelated module cell.

This was the only by-ref/by-value disagreement among the 86 declarations,
and readpmc is one of the natives the test suite never calls, which is how
it survived. The doc comment already described the by-ref intent.