Add VNET_NFSD support to the rpcsec_tls so NFS-over-TLS works in vnet prisons

[rmacklem]

Summary

D37519 adds support for mountd/nfsd to run in a vnet prison.
This patch adds the same support to the rpcsec_tls, so that
rpc.tlsservd can run in a vnet prison. This allows nfsd in a
vnet prison to support NFS-over-TLS client mounts.

I used KRPC_VNETxxx macros similar to NFSD_VNETxxx macros
to do the conversion.

Please do not review this until you have had a chance to look
at D37519, since this change is of no use until D37519 is
committed to main.

Test Plan

NFS-over-TLS mounts to vnet prisons running mountd/nfsd
worked. Starting rpc.tlsservd in a vnet prison that does not
have allow.nfsd was tested and did not start up, as expected
for this case.

[jamie]

sys/rpc/rpcsec_tls/rpctls_impl.c

163

I though prison_check_nfsd was made to return true for prison0, so the "jailed() &&" isn't needed. I suppose this gives a quicker path for the usual case though.

[rmacklem]

sys/rpc/rpcsec_tls/rpctls_impl.c

163

Nope. There is no check for jailed() in prison_check_nfsd().
(I had it checking this and returning true, so I didn't need
to do a separate "if (jailed() &&", but you guys didn't like
that semantics.

Currently, for prison0, prison_check_nfsd() first checks
for jailed_without_vnet(), which returns 0 for not in a jail,
so the check fails.
Then it does "if (!prison_allo(cred, PR_ALLOW_NFSD))"
which does succeed and makes prison_check_nfsd() return
false.
--> So a check for jailed() is needed here.

[jamie]

sys/rpc/rpcsec_tls/rpctls_impl.c

163

VNET adds its bit to the prison0 spec, and perhaps VNET_NFSD could as well. I have no idea if there's ever a situation where real root isn't an actual root mountpoint, but there are some weird systems out there.

The prison_check_nfsd semantics I was in favor of were "can my prison do the thing":
prison0: true
prison with permission bits and root mount: true
other prison: false
But the other argument of what it should be is "what works best where it's used," and overall I'm not sure what that is.

Sorry about the bikeshed. It'll look nice once it's painted.

[rmacklem]

I was a bit lazy and did not malloc two arrays
of length 16 that went in the vnet.

This version of the patch does malloc these
arrays, so that the size of the vnet is kept small.

[rmacklem]

This version replaces the bogus jailed_without_vnet() call
in the osd remove method with a check for the PR_VNET
flag.

[rmacklem]

Replace KRPC_CURVNET_SET() with KRPC_CURVNET_SET_QUIET()
in rpctls_server(), since it will recurse.

[rmacklem]

These changes are now a part of D37519.