Fix arm64 callee saved register set

When I've made a change to optimize the collided exception handling by
copying the stack frame iterator state, I've somehow missed adding two
callee saved registers, x27 and x28 to a list of callee saved registers
and that caused them to not to be copied during the state copying.

It has caused failures in one of the coreclr tests when running with
specific JIT stress settings.

Close dotnet#100476

Author: janvorli

src/coreclr/vm/arm64/cgencpu.h

@@ -27,7 +27,9 @@
     CALLEE_SAVED_REGISTER(X23) \
     CALLEE_SAVED_REGISTER(X24) \
     CALLEE_SAVED_REGISTER(X25) \
-    CALLEE_SAVED_REGISTER(X26)
+    CALLEE_SAVED_REGISTER(X26) \
+    CALLEE_SAVED_REGISTER(X27) \
+    CALLEE_SAVED_REGISTER(X28)
 
 #define ENUM_FP_CALLEE_SAVED_REGISTERS() \
     CALLEE_SAVED_REGISTER(V[8].Low) \