[rtl] Clear branch predictor skid buffer on PC redirect

[zxz2004626]

This PR is to fix #2520 .

The IF-stage skid buffer introduced with BranchPredictor=1 has no invalidation term for pipeline redirects: an occupied skid survives the controller's FLUSH state, so a predicted-taken branch stranded in the skid is executed as the first post-trap instruction with the raised privilege level. From U-mode this turns any synchronous trap into a U->M privilege escalation.

Invalidate the skid whenever pc_set_i is asserted, mirroring the ~pc_set_i term that already guards fill via instr_skid_en.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[zxz2004626]

I have read the CLA Document. By submitting this pull request comment, I am hereby confirming my acceptance of the terms of the CLA Document and my agreement to be legally bound by its terms.