tty: fix a panic with INVARIANTS

watch'ing a tty triggers a refcount wraparound panic, take a reference
on fp after fget_cap_locked() to fix.

Reported by: Michael Jung <mikej_at_paymentallianceintl.com>
Reviewed by: hselasky, mjg
Fixes: f40dd6c8034b ("tty: switch ttyhook_register to use fget_cap_locked")
Differential Revision: https://reviews.freebsd.org/D34335