cred: make the refcount signed

There are asserts on the count being > 0, but they are less useful than
they can be because the type itself is unsigned.

The kernel is compiled with -frapv, making wraparound perfectly defined.

Differential Revision: https://reviews.freebsd.org/D39220