MAC/do: sysctl_rules(): Always copy the rules specification string

[olce]

Summary

This revision is part of a series. Click on the Stack tab below to see the context.
This series has also been squeezed into D47633 to provide an overall view.

Commit message:
We are not guaranteed that the 'rules' storage stays stable if we don't
hold the prison lock. For this reason, always copy the specification
string (under the lock).