restorer: Fix bug in address computation of thread args area

It's wrong to treat restore_thread_exec_start as arguments
area (I managed to overlook this problem in commit
01484182) it's rather
a function start address.

The thread arguments area allocated dynamically after the
restorer blob itself.

We didn't hit any problems earlier simply because there
were a few bytes owerwritten in function prologue.

Signed-off-by: Cyrill Gorcunov <gorcunov@openvz.org>
CC: Andrey Vagin <avagin@openvz.org>
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>