sysctl: Teach sysctl to attach and run itself in a jail

This allows the parent jail to retrieve or set kernel state when child
does not have sysctl(8) installed (e.g. light weighted OCI containers
or slim jails).

This is especially useful when manipulating jail prison or vnet sysctls.
For example, sysctl -j foo -Ja or sysctl -j foo net.fibs=2.

Reviewed by: dfr (previous version), markj
MFC after: 1 week
Relnotes: yes
Differential Revision: https://reviews.freebsd.org/D48618